Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Sign-in and lock last interactive user automatically after a restart

This value controls Winlogon Automatic Restart Sign-On (ARSO).

since 0.9.8.11

Purpose

Show registry keys (1)
  • HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableAutomaticRestartSignOn

This value controls Winlogon Automatic Restart Sign-On (ARSO). Following an eligible restart, or a shutdown followed by a cold boot, ARSO signs in the last interactive user automatically and immediately locks the resulting session. The lock still requires authentication before anyone can access the desktop.

DisableAutomaticRestartSignOn is a REG_DWORD value whose name reflects its inverse logic:

  • 0 allows ARSO.
  • 1 disables ARSO.

Automatic sign-in can occur only if the last interactive user did not sign out before the restart or shutdown.

Notes

Additional effects

ARSO allows Windows Update to complete user-specific processing before the user returns to the device. It also allows lock-screen apps associated with that user to resume in the automatically signed-in, locked session.

The separate AutomaticRestartSignOnConfig setting determines whether ARSO requires BitLocker to be active and unsuspended or can operate regardless of BitLocker status. That setting has no effect when DisableAutomaticRestartSignOn is set to 1.

Security

ARSO causes the Local Security Authority to retain credentials or derived secrets so that Winlogon can restore the user session after the restart. Microsoft states that the saved credentials are deleted from disk immediately after ARSO successfully configures and completes the sign-in. The session is nevertheless a signed-in user session; locking it protects interactive access but does not undo the sign-in.

Microsoft identifies physical access as a relevant threat because an attacker might compromise the platform firmware or TPM protections and obtain credentials retained for ARSO. ARSO can also weaken assumptions made by applications that protect user data with the Data Protection API (DPAPI), since data may become decryptable in the restored session without a fresh interactive entry of the user's credentials.

Winlogon ARSO is not supported with Personal Data Encryption. ARSO must be disabled when that Windows data-protection feature is used.

Possible side effects

When DisableAutomaticRestartSignOn is 1, the previous user's lock-screen apps do not restart automatically after the system restart. User-specific update processing that ARSO would have completed in advance may instead be deferred until a normal sign-in occurs.

Notes

On devices joined to Active Directory or Microsoft Entra ID, this policy applies only to Windows Update restarts. On devices that are not joined to either service, it can also apply to user-initiated restarts and to shutdowns followed by a cold boot.

Microsoft documents the policy as enabled by default when it is not configured. An absent registry value therefore should not be treated as equivalent to an explicit value of 1.

Microsoft documentation

Microsoft Learn: WindowsLogon Policy CSP

Microsoft Learn: Winlogon automatic restart sign-on (ARSO)

Microsoft Learn: Personal Data Encryption settings and configuration

See also