Windows 10 switch to local user

Let’s take a look at how to login with a local account instead of domain account on Windows. By default, when the user enters a username on the Welcome Screen of a domain-joined computer, and there is also a local account with the same name, the domain account will take precedence. We keep coming across people that don’t know this little trick, so we thought it would be worthwhile sharing.

Logging to Local Account on Domain Computer

After the computer is joined to the Active Directory domain, you can sign in under the domain or local user account. On the login screen in Windows XP and Windows Server 2003, there was a drop-down list “Log on to“. Here you could choose whether you want to log in under the domain account or use a local user (select “this computer”).

However, in newer versions of Windows, this drop-down menu no longer exists. If you enter a username here, Windows assumes that you have specified a user account from an Active Directory domain. However, there is no button in the GUI on the Windows logon screen to log under a local user account.

Instead of this, a user is faced with a small button How to log on to another domain which appears near on the domain-joined computers’ Welcome Screen. If you click this button, the following tip will appear:

Type domain namedomain user name to sign in to another domain.
Type NY-FS01local user name to sign in to this PC only (not a domain)

As you can see, the message contains the name of your computer/server (NY-FS01 in our case). If you want login to local account (for example, Administrator), type in NY-FS01Administrator in the User name field and type the password. Of course, if your computer name is quite long, the input can be a real challenge!

Fortunately, there is a simple trick that allows you to sign into local account.

How to Login Local Account without Typing Computer Name?

Windows uses the dot as the alias symbol for the local computer:

1. In the username field simply enter .. The domain below will disappear, and switch to your local computer name without typing it;
2. Then specify your local username after the .. It will use the local account with that username.

You can also type the computer name followed by a backslash and the username, and it will do the same thing.

This way you can login to local account on a domain-joined computer on all Windows versions.

Please note that you won’t be able to log in with your local Windows account to a domain controller. After promoting the member-server to DC (using dcpromo command), the local SAM database becomes unavailable. The only local account on the Active Directory domain controller is the DSRM Administrator.

Tip. You can use the same trick when you need to use the local user credential to access the shared folder over the network (using SMB protocol).

Show All Local Users on Sign-in Screen in Windows

You can also make it easier for your users to login to local account on domain computer by allowing them to display a list of enabled local users on the Windows sign-in screen. You can enable this feature via the Group Policy.

In order to enumerate all local users on Windows Logon Screen:

1. Open the local Group policy editor – gpedit.msc;
2. Expand the following GPO section: Computer Configuration > Administrative Templates > System > Logon;
3. Enable the policy “Enumerate local users on domain-joined computers”;
4. Update local policy settings on your computer using the gpupdate command;
5. Logoff, press Ctrl+Alt+Delete on your Windows Welcome Screen, and check the local account list.

As a result, you don’t need to type the user name manually, but simply select it from the local accounts list and enter its password.

This will work on all supported versions including Windows 10/11 and Windows Server 2016/2019/2022.

If your account is not a member of Administrators. Backup Operators, or Users local security group, you will receive an error when you try to login with local account:

The sign-in method you’re trying to use isn’t allowed. For more info, contact your network administrator

This means that this user or group is not allowed to log on locally. You can configure the list of users and/or groups that are allowed to log on locally using the allow log on locally GPO option.

Switch from a Microsoft Account to a Local Account in Windows 10/11

In the latest builds of Windows 10 and 11 (21H2, 22H1, 22H2), you cannot create a local account when installing Windows. Microsoft recommends using Microsoft accounts instead of local Windows accounts. In order for Windows Setup to prompt you to create a local account, you must disable your Internet connection (Wi-Fi or Ethernet) when you install Windows.

In Windows, you can use three types of accounts to sign in to the device:

• Local account — these accounts are stored in the local Windows security account database (Security Account Manager, SAM). You can list local users on a computer with the command:

  net user

  
• Domain user — accounts are stored on the Active Directory domain controllers;
• Microsoft account — the account is stored in the Microsoft cloud. Its advantage is that you can use it on any computer, and the basic user settings with a Microsoft account will be the same on any Windows computer. For the Microsoft account, as well as for local users, a separate profile is created in the C:Users directory (%UserProfile%). Any local account can be linked to a Microsoft account.

Hint. Can you sign in with a Microsoft account without an Internet connection? Of course! You just  need to stay connected to the Internet when creating a Microsoft account or switching to a local account. After the first login, the credentials of that account are cached locally, and subsequent logins don’t require an Internet connection.

If you do not want to use the Microsoft account on Windows, you can switch to a traditional local Windows account.

1. Open the menu Settings > Accounts > Your info;
2. Click on the button Sign in with a local account instead;
3. Enter your current Microsoft account password or PIN;
4. Specify a username, password, and a password hint for your new local Windows account;
5. Press the Sign out and finish button;
6. Now you can sign in to local account on this Windows computer.

Once you complete these steps, your Windows account will be disconnected from your Microsoft account.

How to Login Windows via Remote Desktop (RDP) with a Local Account?

The above trick for logging into a domain-joined Windows device under a local account using the .Administrator account format does not work if you logging into a remote computer over RDP.

When you specify .administrator in the Remote Desktop Connection client window (mstsc.exe), your RDP client resolves that to <your_current_computername>Administrator, and not to <remote_server _name>Administrator.

Accordingly, you will not be able to RDP into a remote computer if the passwords of the local and remote users are different.

To connect to a remote domain computer via RDP with a local Windows account, you can use one of the following formats for specifying the username:

• Specify the host name of the remote computer, eg:

  wks323221sadministrator

• Specify the IP address of the remote computer:

  192.168.100.221administrator

• Use shorthand local instead of remote machine name:

  local administrator

In all of these cases, the RDP client will understand that it needs to use the local Windows user on the remote computer to authenticate.

In order for a local user to be able to connect to a domain computer via RDP, he must be a member of the Remote Desktop Users group, or added to the local policy Allow Log on through Remote Desktop Services in the following section of the GPO editor (Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights).

Otherwise, you will see an error:

To sign in remotely you need the right to sign in through Remote Desktop Services. By default, members of the Administrators group have this right, or if the right has been removed from the Administrators group, you need to be granted this right manually.

By default, RDP login is allowed only for members of the local Administrators group.