Auto-logon but with lockscreen on PC, is it possible?

Question

I use my PC as a server and want to run apps without logging in manually. They cannot run as a service and apps that can convert apps to services like NSSM also don't work perfectly.

So basically when you remote login to a PC, although you can access the PC remotely because you logged in, the PC itself is locked so no one with physical access to my PC can access it. And that is my question: is there a way to automatically log in when powered on such that my startup apps start (with GUI, not as a service) but the PC is locked and no one can use it?

I use Windows 10.

Answer 1

Yes, this is possible.

You need 2 steps for this. Step 1 is to enable automatic login.

I created a script for my own use as my computers are domain joined which requires adding stuff to the registry on beforehand. If your computer is not domain joined, you can probably use control userpasswords2 and skip the registry part, not requiring the script either.

But the script is handy anyway, and it will work with or without domain joined pc's.

Here's the script:

@echo off
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /t REG_SZ /d "1" /f >nul


echo In the following dialog, check and uncheck the 
echo "users must enter their username and passwords to login", and hit apply.
echo.
echo Specify the username as: DOMAIN\Administrator or it will attempt to logon 
echo  locally.
echo.
set /p q=Press {enter} to continue.

control userpasswords2

Paste the above in a .cmd file and run it as administrator.

Make sure you enter the username correctly or it will not automatically log you in. You can run the script as many times as you wish though, so enalbe it, reboot and test that it automatically logs you in.

The second part is to now automatically lock the computer. In theory you could say: I'll use Power Management and a 1 minute delay, but you can also use a command for it.

Create a new .cmd script and paste the following code in there:

rundll32.exe user32.dll,LockWorkStation

Place this cmd in shell:startup (entering that in the explorer addressbar and then pressing enter will bring you to the right location)

If the computer boots, it automatically logs in, and about 20 seconds later, its locking the computer. Anyone who is behind the computer will automatically be send to the lock screen too, and only you can then unlock it. It will stay unlocked until you lock it again manually.

Of course, remote desktop into the computer will keep the lockscreen active anyway.

Answer 2

What you are probably looking for is ARSO — Winlogon Automatic Restart Sign-On.

It is a group policy that automatically logs in last user that was logged in at restart/shutdown time and immediately locks the workstation. This way your GUI (i.e. non-service) startup apps run as if you have logged in manually, but do this behind the scenes while the OS never goes past login screen itself and is left prompting for a password.

It is set up by two policies*:

1. Sign in and lock last interactive user automatically after restart
2. Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot

Both can be found in Group Policy Editor under Computer Configuration > Administrative Templates > Windows Components > Windows Logon Options or, alternatively, set directly via registry keys outlined in the article linked above.

* — if the first policy is not disabled, then only the second policy needs to be configured

Answer 3

I know this is old but I wanted to mention this: LockWorkStation

Also this: Look for Auto Login & Lock v1.0

I have used this many times on servers and workstations.