The Windows Logon Policy controls how Windows presents accounts and user-switching options at sign-in. Use it to balance sign-in convenience with the privacy of account information on managed devices.

The policy provides three settings:

These settings change the Windows sign-in experience. They do not create or delete accounts, reset passwords, grant administrator rights, configure automatic sign-in, or replace authentication requirements.

Use a Windows release that is still covered by your organization's servicing arrangements. The minimum versions above describe feature availability, not a recommendation to deploy older releases.

Microsoft documents device-level applicability in the WindowsLogon Policy CSP and LocalPoliciesSecurityOptions Policy CSP.

The Swif policy form declares the following field defaults:

An omitted setting is not necessarily the same as explicitly selecting Disabled. Existing Windows configuration or another management policy may affect the result. Review the saved values and test the effective behavior.

Controls whether Windows lists local user accounts on domain-joined computers.

Enable this setting when users of a domain-joined PC need to select local accounts from the sign-in screen.

This is not a directory of all domain users. It also does not enable disabled accounts or give an account permission to sign in. Do not assume that an Entra-only joined or workgroup device will behave like an Active Directory domain-joined device; verify the actual join state and sign-in experience.

Controls whether Windows displays the last signed-in user's identity.

Enable this setting on devices where exposing a recent user's identity is undesirable, such as shared workstations or devices in publicly accessible locations.

Before deployment, make sure employees know their Windows sign-in name. For example, a local account can be identified as \.username, and an Active Directory account as DOMAIN\username or its user principal name when supported.

This setting is not a guarantee that all identifying information is hidden everywhere. Windows has separate controls for information shown on a locked session and during sign-in. See Microsoft's explanation of Don't display last signed-in.

Controls access to the Switch User interface in the sign-in screen, Start menu, and Task Manager.

Hiding the interface is not the same as signing out existing sessions or enforcing a single-session security boundary. Do not use it as a substitute for account restrictions or session-management controls.

Use these examples as starting points, then test with the device's join type and credential providers.

For the shared-PC example, the convenience of account selection comes with greater visibility of local usernames. For the third example, document the sign-out procedure and test help-desk access before deployment.

Avoid treating Enumerate Local Users and Don't Display Last Username as independent promises that every tile will both appear and be hidden. They affect related parts of the interface. If predictable account tiles are the goal, start with the shared-PC configuration and test it.

Before testing: Save open work, confirm a working administrator recovery method, and tell the test user what will change. Signing out closes applications and can discard unsaved work.

If Windows continues showing an older interface, arrange a restart at a suitable time and test again. Do not restart a production device without notifying its user.

On editions with the relevant administrative consoles, the corresponding Windows settings are:

These locations help identify overlapping Group Policy configuration. A local policy editor alone is not proof that an MDM setting applied successfully. Use the Swif report and observed behavior as well.

Seeing only SwifAdmin or another administrator tile does not mean the employee account was deleted.

Check the following:

If Other user is available, try the correct account name, such as \.username for a local account. Do not delete or recreate an account solely because its tile is missing.

This is expected when Don't Display Last Username is enabled. Provide employees with their approved sign-in format. If visible account tiles are required instead, review the configuration with your security team.

Check Hide Fast User Switching. If it is enabled intentionally, users should save work and follow the approved sign-out procedure before another user signs in. If switching should remain available, set it to disabled and check for conflicting management settings.

Confirm that the device meets the setting's minimum version and domain-join requirement. Then check account status, other sign-in privacy settings, and credential-provider behavior. Enabling enumeration does not override every other condition affecting account tiles.

Confirm the Windows edition and build, MDM enrollment status, connectivity, and the most recent policy report. Review Windows MDM diagnostics under Event Viewer > Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin.

Also check whether Group Policy, another MDM service, a hardening script, or another Swif policy manages the same settings. Do not assume one system always wins; resolve overlapping management deliberately.

This policy does not reset credentials or unlock accounts. Investigate the account name, account status, password or PIN, domain connectivity, and credential provider separately from tile visibility.

To change behavior, edit the policy, save it, allow devices to check in, and repeat the sign-in tests.

To stop managing these settings, remove the policy assignment and verify the resulting configuration. Do not assume removal restores an earlier value or overrides settings delivered by another management system. If a specific rollback state is required, test it on a pilot device first.

Removing this policy does not remove Windows user accounts.