Accounts: Limit local account use of blank passwords to console logon only
`LimitBlankPasswordUse` is a `DWORD` value associated with the corresponding Windows security option.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\LimitBlankPasswordUse
LimitBlankPasswordUse is a DWORD value associated with the corresponding Windows security option. A value of 1 enables the restriction: a local user account with a blank password cannot be used for network logons or remote interactive logons. This includes, for example, Remote Desktop Services and network services that rely on Windows authentication.
Interactive sign-in at the physical console remains available. The setting does not apply to domain accounts.
Notes
Security
The setting prevents a remote user from using a local account through supported Windows logon mechanisms merely by knowing its user name when the account has no password. It therefore reduces exposure to unauthorized network access through blank-password local accounts.
It does not prevent local accounts from having blank passwords, nor does it block their use at the physical console. Applications that implement their own authentication or use remote logon mechanisms outside the Windows enforcement path might not be subject to this restriction.
Possible side effects
Remote access, services, or applications that authenticate with a blank-password local account can no longer complete a Windows network or remote interactive logon. Supplying the correct user name does not overcome the restriction while the account still has a blank password.
Notes
This is a computer-level security option. The value 1 represents the enabled policy state. A restart is not required; the restriction applies to subsequent logon attempts.
Microsoft documentation
Microsoft Learn: Accounts: Limit local account use of blank passwords to console logon only
Microsoft Learn: Windows security baseline for Windows Server 2025