Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows 10 Version 1903
Path in the GPO console
Computer Configuration\Administrative Templates\Windows Components\Windows Logon Options Description
This policy setting controls the configuration under which an automatic restart and sign on and lock occurs after a restart or cold boot. If you chose “Disabled” in the “Sign-in and lock last interactive user automatically after a restart” policy, then automatic sign on will not occur and this policy does not need to be configured. If you enable this policy setting, you can choose one of the following two options: 1. “Enabled if BitLocker is on and not suspended” specifies that automatic sign on and lock will only occur if BitLocker is active and not suspended during the reboot or shutdown. Personal data can be accessed on the device’s hard drive at this time if BitLocker is not on or suspended during an update. BitLocker suspension temporarily removes protection for system components and data but may be needed in certain circumstances to successfully update boot-critical components. BitLocker is suspended during updates if: - The device doesn’t have TPM 2.0 and PCR7, or - The device doesn’t use a TPM-only protector 2. “Always Enabled” specifies that automatic sign on will happen even if BitLocker is off or suspended during reboot or shutdown. When BitLocker is not enabled, personal data is accessible on the hard drive. Automatic restart and sign on should only be run under this condition if you are confident that the configured device is in a secure physical location. If you disable or don’t configure this setting, automatic sign on will default to the “Enabled if BitLocker is on and not suspended” behavior.
Registry
Software\Microsoft\Windows\CurrentVersion\Policies\System MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/WindowsLogon/ConfigAutomaticRestartSignOn Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot
; State: Enabled
; Supported on: At least Windows 10 Version 1903
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"AutomaticRestartSignOnConfig"=dword:00000000More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot
# State: Enabled
# Supported on: At least Windows 10 Version 1903
$path = 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'AutomaticRestartSignOnConfig' -Value 0 -Type DWordIntune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/WindowsLogon/ConfigAutomaticRestartSignOn
Data type: String
Value:
<enabled/>
<data id="ConfigAutomaticRestartSignOnDescription" value="0"/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot
# State: Enabled
# Supported on: At least Windows 10 Version 1903
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'AutomaticRestartSignOnConfig' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot
# State: Enabled
# Supported on: At least Windows 10 Version 1903
$path = 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'AutomaticRestartSignOnConfig' -Value 0 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot
# State: Enabled
# Supported on: At least Windows 10 Version 1903
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot
# State: Enabled
# Supported on: At least Windows 10 Version 1903
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'AutomaticRestartSignOnConfig' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot
# State: Enabled
# Supported on: At least Windows 10 Version 1903
$path = 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'AutomaticRestartSignOnConfig' -Value 0 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.