Article ID: 281250
Article Last Modified on 1/25/2006
APPLIES TO
- Microsoft Windows XP Professional
This article was previously published under Q281250
Important This article contains information about how to modify the registry. Make sure to back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986 Description of the Microsoft Windows registry
SUMMARY
This article describes the behaviors to expect when you attempt to unlock a locked workstation.
Note This behavior only happens when you have Fast User Switching disabled. (When you join a Windows XP Professional computer to a domain, the Welcome Screen logon (and Fast User Switching) is disabled.)
MORE INFORMATION
You can unlock a workstation either manually or by means of a program (for example, by using a screen saver). When the workstation is locked and you attempt to unlock it, you can observe standard expected behaviors from the unlocking process.
When a user logs on to a computer, the Winlogon Service stores a hash of the user's password for future unlock attempts. When the user attempts to unlock the workstation, this stored copy of the password is verified. If the password entered at the unlock dialog request and stored hash match, the workstation is unlocked. If the password entered does not match the stored hash, the workstation attempts to logon (authenticate the password). If the logon process succeeds, the local hash is updated with the new password. If the logon process is unsuccessful, the unlock process is also unsuccessful.
Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.
The preceding process has been designed to limit network traffic generated by the workstation. However, if more stringent behavior is needed, there is a registry entry to force the workstation to logon (authenticate) at every unlock attempt. The following registry setting is received every time the computer is locked:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
ForceUnlockLogon
REG_DWORD
0 - Do not force authentication inline (default)
1 - Require online authentication to unlock
The preceding value controls whether a full logon is performed during the unlock process. This can force a validation at the domain controller for the user attempting the unlock process.
Note If the value is not present, it functions as if it had been set to 0 (zero).
For more information about the ForceUnlockLogon registry value, click the following article numbers to view the articles in the Microsoft Knowledge Base:
188700 Screensaver password works even if account is locked out
Keywords: kbhowto KB281250
