Full Report
A previously unknown trick lets you easily bypass using a Microsoft Account in Windows 11, just as Microsoft tries to make it harder to use local accounts. [...]
Analysis Summary
# Best Practices: Windows 11 Local Account Installation Control
## Overview
These practices focus on securing the Windows 11 deployment process by ensuring administrative control over account provisioning, specifically detailing a confirmed method to bypass the mandatory Microsoft Account (MSA) requirement during setup in favor of a local user account. Maintaining control over user accounts is critical for security governance, device management, and adherence to organizational security policies.
## Key Recommendations
### Immediate Actions
1. **Utilize Command Prompt Bypass During OOBE:** During the Windows 11 Out-of-Box Experience (OOBE), specifically at the "Let's connect you to a network" screen, immediately execute the command sequence to enforce a local account setup.
2. **Execute Local Account Creation Command:** At the command prompt (launched via **Shift+F10**), type the command: `start ms-cxh:localonly` and press **Enter** to trigger the window allowing the creation of a local user during installation.
### Short-term Improvements (1-3 months)
1. **Document Approved Provisioning Procedures:** Update all IT deployment documentation to reflect the approved method(s) for provisioning Windows 11 installations (whether using MSA or local accounts), explicitly referencing the `ms-cxh:localonly` utilization if local accounts are permitted.
2. **Enforce Device Management Enrollment:** For any device provisioned locally—or immediately after setup if a local account is used—mandate immediate enrollment into the organizational Mobile Device Management (MDM) solution (e.g., Intune, SCCM) to apply Group Policies and security baselines.
3. **Verify Account Type Post-Installation:** Develop a checklist step requiring technicians to verify that the final setup account aligns with policy (Start button > User Account Name check).
### Long-term Strategy (3+ months)
1. **Establish Centralized Credential Management:** If local accounts are permitted, establish a robust, centralized system for securely managing and rotating local administrator passwords (e.g., using a privileged access management solution) to prevent credential sprawl.
2. **Implement Forced MSA Usage Policy (If Applicable):** For all corporate-owned or sensitive devices, transition deployment methods (e.g., using Autopilot or provisioning packages) that *force* the linking of the device to an Azure Active Directory/Microsoft 365 account, thereby eliminating the need to bypass the MSA requirement.
3. **Monitor Windows Update Behavior:** Track official Microsoft announcements regarding Windows 11 updates, as Microsoft frequently patches setup vulnerabilities, including bypass methods like the one described.
## Implementation Guidance
### For Small Organizations
- **Adopt the Bypass for Simplicity:** Use the documented **Shift+F10** method to quickly create local accounts for new systems where centralized identity management is not yet in place, allowing for faster initial deployment.
- **Standardize Local Admin Naming:** If using local accounts, standardize the local administrator username (e.g., "LocalAdmin") across all deployed machines for easier baseline management.
### For Medium Organizations
- **Test Against MDM Enrollment:** Verify that devices provisioned using the `ms-cxh:localonly` method enroll correctly into the MDM solution and that security policies successfully overwrite local settings post-enrollment.
- **Restrict OOBE Access:** For high-security environments, consider using provisioning techniques that skip the full OOBE networking screens altogether, thereby preventing unauthorized users or technicians from manually executing bypass commands.
### For Large Enterprises
- **Implement Provisioning Packages (PPKG):** Standardize deployment using customized PPKGs or Autopilot profiles that define the desired account type (MSA or local) prior to OOBE, thereby hardening the process against manual circumvention.
- **Audit Setup Logs:** Implement auditing on deployment media storage or imaging servers to track when and by whom these bypass methods might be executed outside of standardized procurement channels.
## Configuration Examples
The key configuration step involves executing a specific command during the network connection phase of OOBE:
| Step | Action | Command Line Input | Result |
| :--- | :--- | :--- | :--- |
| 1 | Reach Network Setup Screen (OOBE) | N/A | Indicates device is online/requires network connection. |
| 2 | Open Command Prompt | Press **Shift + F10** | Opens `cmd.exe`. |
| 3 | Execute Bypass Command | `start ms-cxh:localonly` | Launches the window prompting for local user setup information. |
| 4 | Complete Local Setup | Fill out form and click **Next** | Setup proceeds using the newly created local account. |
## Compliance Alignment
This topic primarily relates to **Configuration Management** and **Identity and Access Management (IAM)** controls, even though the context is a setup exploit workaround.
- **CIS Benchmarks (Windows 11):** Focuses on baseline security and secure system hardening post-installation. If local accounts are used, adherence to CIS recommendations on strong password policies for local accounts is crucial.
- **NIST SP 800-53 (AC-2, IA-2):** Relates to Account Management and Identification and Authentication. Allowing unmanaged local accounts without proper controls increases the risk of non-compliance with identity standards.
- **ISO/IEC 27002 (A.5.15, A.8.2):** Aligns with procedures for access control and identity management. Centralized identity control (MSA/AAD) is preferred over disparate local credentials.
## Common Pitfalls to Avoid
- **Assuming Local Accounts are Secure:** Allowing local accounts without enforcing complex passwords or migrating the account to Azure AD/MDM creates an unmanaged shadow account that bypasses corporate security policies, device encryption, and threat detection tools.
- **Ignoring OOBE Security:** Treating the OOBE phase as non-critical. Vulnerabilities here (like this command injection) allow unauthorized configuration before proper security baseline application.
- **Incomplete Patching:** Assuming this command will be universally patched by Microsoft immediately. The IT team must rely on established management tools, not the security of the installation wizard, for final configuration control.
## Resources
- **Official Microsoft Documentation:** Consult Microsoft's guidance on Windows Provisioning Options (Autopilot, PPKG) for officially supported, secure deployment methods that align with centralized identity requirements. (Note: Direct links to non-official exploit guides are omitted.)
- **Microsoft Support Articles:** Monitor official Microsoft documentation for announcements detailing the removal or replacement of OOBE bypass mechanisms.