How do I remove the "Reset Password" option from the Windows 10 login screen?

Question

I've installed Windows 10 Professional on a PC with only one account, a local administrator. This PC needs to be as secure as possible and it will also never be attached to a Microsoft account. The local admin account is the only account this PC will ever have. At the moment I am still inexperienced with Windows 10 and configuring it securely so I'm not sure how to remove the password reset option from the login screen.

If you're unfamiliar with the option I'm referring to, when I type the admin account password incorrectly once, a "Reset Password" link shows up below the password box which then allows me to reset the password if I provide the correct answers to the security questions that are displayed after clicking the link. This may be OK in a home/personal setting but I find this highly insecure in a business setting.

The security questions you can choose from to protect the reset are "canned" and refer to very common or easy to come by information about a person and therefore are not very secure. I would like to know how to remove this reset link from the login screen, making it much more difficult for anyone to reset the password without actually logging in to the account first.

I have been searching for the answer to this question but all I can find so far are results like "how to bypass the login screen" or "how to remove the login password." ...Let me be very clear, I am not interested in answers to either of those questions. My question is very specifically "How do I get rid of/turn off the option to reset a local account's password from the Login screen?"

I am hoping there may be something available in group/local policy that can be turned off in order to achieve the desired effect?

Answer 1

There is a way to avoid choosing security questions and answers when setting up Windows 10. During setup, do not specify a password. Leave it blank. You will not be asked for security questions. Once you're set up, press Ctrl-Alt-Del and change the password from blank to the password you want.

If someone puts in an incorrect password at the login screen, the "reset password" link will appear, but upon clicking it, they will receive the error: "This feature requires removable media, such as a USB flash drive. Please connect a USB flash drive, and then try again."

To reset the password via this method, one needs to create a password reset USB drive while logged in as that user.

https://www.isumsoft.com/windows-10/how-to-reset-windows-10-forgotten-password-with-usb.html

However, as noted in the above article, someone can still gain access to the account if they can get the machine to boot from a USB drive. You will have to edit the BIOS settings of the computer and disable booting from a USB drive if you are concerned about this.

Of course, someone can always change it back, so you must set a password in the BIOS settings to prevent that.

At this point, you should be secure. A potential hacker would have to open the case of the machine and put a jumper on the CMOS reset pins on the motherboard to wipe out the BIOS password to get in.

Answer 2

Since I didn't want to reinstall Windows to fix this problem unless there was no other way, I kept on looking. I finally came up with the correct search terms to produce a useful result. The answer from Scott looks like it should work (I didn't test it) if you have not finished installing Windows and maybe also when you are creating a new user. However I found a solution that will work if you've already completed installing Windows and setup a local administrator account.

I believe the following steps only work for the Professional or Enterprise editions of Windows 10 since the Home edition supposedly does not have access to the Group Policy Editor.

To prevent the Reset Password link on the login page from showing security questions, perform the following steps:

1. Open the Start menu.
2. Search for gpedit.msc and run it to open the Local Group Policy Editor.
3. In the editor, browse the following path: Computer Configuration > Administrative Templates > Windows Components > Credential User Interface
4. On the right side, double-click the "Prevent the use of security questions for local accounts" policy to edit it.
5. Select the Enabled option to turn OFF security questions.
6. Click Apply.
7. Click OK.
8. Close the Group Policy Editor.

You can check to make sure the change worked by locking the screen and then typing the password wrong. The Reset link will still be visible, but as in Scott's answer, this solution will also remove the security questions and instead show a popup stating "This feature requires removable media, such as a USB flash drive. Please connect a USB flash drive, and then try again."

Additionally, when creating new accounts after enabling this policy, you will no longer be asked to provide security questions.

If you wish to revert back to using security questions, edit the same group policy and change the setting from Enabled, back to Not Configured.

Reference: https://www.windowscentral.com/how-disable-security-questions-local-accounts-windows-10