I use my PC as a server and want to run apps without logging in manually. They cannot run as a service and apps that can convert apps to services like NSSM also don't work perfectly.

So basically when you remote login to a PC, although you can access the PC remotely because you logged in, the PC itself is locked so no one with physical access to my PC can access it. And that is my question: is there a way to automatically log in when powered on such that my startup apps start (with GUI, not as a service) but the PC is locked and no one can use it?

I use Windows 10.

  • 1
    I believe Windows 10 will do this by default if you have the "install updates before I log in" feature enabled (or whatever it's called).
    – gronostaj
    Jun 15, 2022 at 10:32
  • @gronostaj no, if an app is installed for a user account only, it will only start if that user logs in.
    – LPChip
    Jun 15, 2022 at 10:40
  • The easiest way to do this may be to configure the user for auto-login, then set a task to lock the PC once logged in
    – JW0914
    Jun 15, 2022 at 10:49
  • 2
    Note that for programs that can't run as a service, you can set up task scheduler to run programs at system startup under a normal user account.
    – bta
    Jun 15, 2022 at 21:59

3 Answers 3


Yes, this is possible.

You need 2 steps for this. Step 1 is to enable automatic login.

I created a script for my own use as my computers are domain joined which requires adding stuff to the registry on beforehand. If your computer is not domain joined, you can probably use control userpasswords2 and skip the registry part, not requiring the script either.

But the script is handy anyway, and it will work with or without domain joined pc's.

Here's the script:

@echo off
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /t REG_SZ /d "1" /f >nul

echo In the following dialog, check and uncheck the 
echo "users must enter their username and passwords to login", and hit apply.
echo Specify the username as: DOMAIN\Administrator or it will attempt to logon 
echo  locally.
set /p q=Press {enter} to continue.

control userpasswords2

Paste the above in a .cmd file and run it as administrator.

Make sure you enter the username correctly or it will not automatically log you in. You can run the script as many times as you wish though, so enalbe it, reboot and test that it automatically logs you in.

The second part is to now automatically lock the computer. In theory you could say: I'll use Power Management and a 1 minute delay, but you can also use a command for it.

Create a new .cmd script and paste the following code in there:

rundll32.exe user32.dll,LockWorkStation

Place this cmd in shell:startup (entering that in the explorer addressbar and then pressing enter will bring you to the right location)

If the computer boots, it automatically logs in, and about 20 seconds later, its locking the computer. Anyone who is behind the computer will automatically be send to the lock screen too, and only you can then unlock it. It will stay unlocked until you lock it again manually.

Of course, remote desktop into the computer will keep the lockscreen active anyway.

  • 2
    Yes but a risk is there in those 20 seconds. I am more looking for a way in which my PC is not vulnerable, meaning the PC stays locked always but logged in just like it stays locked when you log in remotely. Jun 15, 2022 at 12:01
  • 2
    That is not possible. The way Microsoft designed it is like this: either you ensure that this is a remote system that no one can get to, aka a server in a data center or you make sure the program runs as service so it doesn't matter if a user is logged in or not. I too needed my desktop to load but wanted to lock the system so I came up with this workaround. I usually make sure the computer is just always on and a reboot happens at night. A user can't do much from boot until it locks, so its pretty safe. If its not for you, then there's no way. You will need to make compromises.
    – LPChip
    Jun 15, 2022 at 12:25
  • Well that is sad. I will now need to determine how easy will it be to exploit that risk. If it is hard enough for regular hacker to exploit it, I might go with it. What is your opinion though regarding how easy/hard it is to exploit in 20 seconds? Jun 15, 2022 at 12:31
  • 1
    Its hard to exploit because there just is not much you can do in those 20 seconds. Only if you know what you do, you may be able to find it. If you want to be really sure, create a startup task in task scheduler and make it also lock the computer. A hacker has to continuously reboot the computer in order to do something. In most cases, hackers will not even be interested in this. Hackers usually work remote anyway, and this is not a protection against that. Thieves will just steal the computer and remove the harddrive. Colleagues are usually not skilled enough.
    – LPChip
    Jun 15, 2022 at 12:36
  • 2
    colleagues usually try once, computer locks and then just give up. Oh and a colleague with hacking skills or the IT department, sorry, but you cannot prevent access to them. They will find a way in if they have the time and desire.
    – LPChip
    Jun 15, 2022 at 12:36

What you are probably looking for is ARSO — Winlogon Automatic Restart Sign-On.

It is a group policy that automatically logs in last user that was logged in at restart/shutdown time and immediately locks the workstation. This way your GUI (i.e. non-service) startup apps run as if you have logged in manually, but do this behind the scenes while the OS never goes past login screen itself and is left prompting for a password.

It is set up by two policies*:

  1. Sign in and lock last interactive user automatically after restart
  2. Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot

Both can be found in Group Policy Editor under Computer Configuration > Administrative Templates > Windows Components > Windows Logon Options or, alternatively, set directly via registry keys outlined in the article linked above.

* — if the first policy is not disabled, then only the second policy needs to be configured


I know this is old but I wanted to mention this: LockWorkStation

Also this: Look for Auto Login & Lock v1.0

I have used this many times on servers and workstations.

  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    May 1 at 17:54
  • 2
    Hello, please describe the provided apps/tools instead of just linking them, the linked sites could easily disappear in the future.
    – Destroy666
    May 1 at 17:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .