My work laptop (Windows 11) keeps signing in without requiring my pin or finger print

Question

My work PC has Windows Hello enabled and allows us to sign in with a six-digit pin or a finger print, notably not with facial recognition. Over the past week, each morning when I turn my computer on for the first time and ctrl-alt-del into what is usually the pin or finger-print step, it skips this authentication entirely and fully just logs in. This started after the most recent update and seems like a very real security risk.

Edition Windows 11 Enterprise

Version 24H2

Installed on ‎6/‎5/‎2025

OS build 26100.8893

Experience Windows Feature Experience Pack 1000.26100.334.0

Answer 1

Hi Abe Winterscheidt,

Thank you for sharing the details of the issue.

Based on the behavior described, this may be related to the Windows Automatic Restart Sign-On (ARSO) feature. ARSO can automatically sign in the last interactive user after a Windows Update restart so Windows can finish update-related user setup tasks. The session should normally be locked afterward, but this behavior can make it appear that Windows Hello PIN or fingerprint authentication was skipped.

To prevent this automatic sign-in behavior, please disable ARSO using one of the following methods.

Option 1: Disable ARSO by Group Policy

Please configure the following policy as Disabled:

• Computer Configuration -> Administrative Templates -> Windows Components -> Windows Logon Options -> Sign-in and lock last interactive user automatically after a restart.

Option 2: Disable ARSO by Registry

If Group Policy is not being used, please run the following command with administrator privileges:

• reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableAutomaticRestartSignOn /t REG_DWORD /d 1 /f

This sets DisableAutomaticRestartSignOn to 1, which disables the automatic restart sign-on behavior.

In addition, please also verify that legacy automatic logon is not enabled on the device. Check the following registry path:

• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

If AutoAdminLogon is set to 1, change it to 0:

• reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /t REG_SZ /d 0 /f

If a DefaultPassword value exists under the same registry path, please remove it after confirming it is not required for any approved kiosk or managed sign-in scenario:

• reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /f

Finally, please check the local sign-in setting below and make sure Windows requires sign-in after the device wakes or resumes:

• Settings > Accounts > Sign-in options > Additional settings

Set If you’ve been away, when should Windows require you to sign in again? to the strictest available option allowed by your organization’s policy.

===================

We hope the steps above help you solve your problem. If this helps resolve your problem, please consider hitting "Accept Answer" so other users facing this failure can easily find the solution!