Accounts: Limit local account use of blank passwords to console logon only
A `REG_DWORD` value of `1` enables this computer-wide security option.
since 0.9.8.11
Purpose
Security policy: [Registry Values] MACHINE\System\CurrentControlSet\Control\Lsa\LimitBlankPasswordUse = 4,1
A REG_DWORD value of 1 enables this computer-wide security option. Local user accounts with blank passwords can no longer be used for network logons or remote interactive logons. This includes, for example, Remote Desktop Services and network services such as Telnet or FTP.
The setting does not prevent an interactive sign-in performed directly at the physical console. It also does not apply to domain accounts.
Notes
Security
The restriction prevents an attacker from using a blank-password local account through the standard Windows network and remote logon mechanisms. It does not assign a password to the account or protect it from someone who has physical access to the device.
Non-Microsoft applications that implement their own remote logon mechanisms might bypass the Windows restriction. This setting therefore does not replace password requirements for local accounts.
Possible side effects
Remote access, shares, or applications that attempt to authenticate with a blank-password local account no longer work through the network and remote logon paths controlled by Windows.
Notes
Microsoft lists Enabled as the effective default for Windows client computers, member servers, domain controllers, and stand-alone servers. Explicitly setting LimitBlankPasswordUse to 1 establishes that state even if the registry value was previously absent.
The change takes effect without a restart. On a domain-joined computer, a security setting distributed through Group Policy can take precedence over the local configuration.
Microsoft documentation
Microsoft Learn: Accounts: Limit local account use of blank passwords to console logon only
Microsoft Learn: Windows security baseline for Windows Server 2025