KB5077181: Unable to switch between logged-in users when using UPN

Coworker sent me this today since we have been looking at this for months...thanks MS. I thought I would share with everyone here and I have not tried one of the solutions yet (Just wanted to post it so it could help someone or give them a better answer/solution).

This issue is primarily caused by how Windows 11 handles cached credentials, Fast User Switching, and User Principal Names (UPN) on shared, domain-joined computers. When a user clicks their name on the lock screen tile, Windows 11 often passes an incomplete or incorrectly formatted cached username string to the Domain Controller. Clicking "Other User" forces Windows to build a fresh, fully explicit authentication request, which is why the same password works flawlessly there. [1, 2, 3]

Because this happens on both an imaged machine and a clean install, it points directly to Windows 11 default behaviors and Group Policies. Follow these steps to resolve the issue. [1]

1. Identify the Culprit (UPN vs. sAMAccountName)

Recent updates to Windows 11 introduced a known bug affecting how cached UPN references (e.g., ******@domain.com) are read from the lock screen. [1]

• The Glitch: When a user locks their session and tries to click their name to log back in, Windows may strip or misinterpret the domain suffix. [1]
• The Test: When clicking "Other User", have your staff log in using the older sAMAccountName format (e.g., DOMAIN\username) instead of their email-style login. If this entirely bypasses the lockout error, the issue is isolated to UPN mapping logic in Windows 11. [1, 2]

2. Disable "Fast Startup"

Windows 11 heavily relies on Fast Startup, which saves kernel state and session components to a hibernation file rather than fully closing out authentication threads. This frequently results in a "cached credentials glitch" on shared PCs. [1]

1. open a command prompt as an Administrator.
2. Run the command: powercfg -h off
3. Alternatively, navigate to Control Panel -> Power Options -> Choose what the power buttons do.
4. Click Change settings that are currently unavailable, uncheck Turn on fast startup, and save changes. [1, 2, 3]

3. Deploy Group Policy Workarounds

If disabling Fast Startup does not resolve the issue, you can use Group Policy Objects (GPOs) to force Windows to handle shared authentication properly.

• Option A: Hide the Last Signed-In User (Most Reliable Fix) The absolute cleanest way to prevent this bug on shared domain computers is to force the screen to always show the "Other User" style fields.
  • Navigate to: Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options.
    • Enable the policy: Interactive logon: Don't display last signed-in (or Don't display last user name depending on your exact AD functional level).
      • Result: Users will always type their username and password, entirely avoiding the corrupted lock screen tile cache. [1, 2, 3, 4, 5]
      • Option B: Adjust the Kerberos and Token Cache Windows 11 features a component called Credential Guard that handles tokens differently than Windows 10.
        • Navigate to: Computer Configuration -> Administrative Templates -> System -> Logon.
          • Ensure Block enumeration of local users on domain-joined computers is Enabled.
            • Ensure Turn on convenience PIN sign-in is Disabled if your users do not use Windows Hello for Business, as it can interfere with standard domain password caching. [1, 2, 3, 4, 5]

4. Clear the Local Token Cache

If specific user profiles continue to break on the lock screen, their local cached Kerberos tickets might be corrupted. [1, 2]

1. Have the user log into their desktop via the "Other User" workaround.
2. Open Command Prompt and type: klist purge
3. This clears out their locally cached tickets and forces the computer to pull fresh authentication parameters from the Domain Controller the next time they lock and unlock the machine. [1, 2]

To help narrow down the fastest fix, could you let me know:

• Do your users log in using their email address format (UPN) or the traditional DOMAIN\username (sAMAccountName) format?
• Is forcing the "Other User" blank login screen via GPO an acceptable permanent solution for these shared terminals? This issue is primarily caused by how Windows 11 handles cached credentials, Fast User Switching, and User Principal Names (UPN) on shared, domain-joined computers. When a user clicks their name on the lock screen tile, Windows 11 often passes an incomplete or incorrectly formatted cached username string to the Domain Controller. Clicking "Other User" forces Windows to build a fresh, fully explicit authentication request, which is why the same password works flawlessly there. [1, 2, 3] Because this happens on both an imaged machine and a clean install, it points directly to Windows 11 default behaviors and Group Policies. Follow these steps to resolve the issue. [1] 1. Identify the Culprit (UPN vs. sAMAccountName) Recent updates to Windows 11 introduced a known bug affecting how cached UPN references (e.g., ******@domain.com) are read from the lock screen. [1]
  • The Glitch: When a user locks their session and tries to click their name to log back in, Windows may strip or misinterpret the domain suffix. [1]
  • The Test: When clicking "Other User", have your staff log in using the older sAMAccountName format (e.g., DOMAIN\username) instead of their email-style login. If this entirely bypasses the lockout error, the issue is isolated to UPN mapping logic in Windows 11. [1, 2]
  2. Disable "Fast Startup" Windows 11 heavily relies on Fast Startup, which saves kernel state and session components to a hibernation file rather than fully closing out authentication threads. This frequently results in a "cached credentials glitch" on shared PCs. [1]
  1. open a command prompt as an Administrator.
  2. Run the command: powercfg -h off
  3. Alternatively, navigate to Control Panel -> Power Options -> Choose what the power buttons do.
  4. Click Change settings that are currently unavailable, uncheck Turn on fast startup, and save changes. [1, 2, 3]
  3. Deploy Group Policy Workarounds If disabling Fast Startup does not resolve the issue, you can use Group Policy Objects (GPOs) to force Windows to handle shared authentication properly.
  • Option A: Hide the Last Signed-In User (Most Reliable Fix)
    The absolute cleanest way to prevent this bug on shared domain computers is to force the screen to always show the "Other User" style fields.
    • Navigate to: Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options.
    • Enable the policy: Interactive logon: Don't display last signed-in (or Don't display last user name depending on your exact AD functional level).
    • Result: Users will always type their username and password, entirely avoiding the corrupted lock screen tile cache. [1, 2, 3, 4, 5]
  • Option B: Adjust the Kerberos and Token Cache
    Windows 11 features a component called Credential Guard that handles tokens differently than Windows 10.
    • Navigate to: Computer Configuration -> Administrative Templates -> System -> Logon.
    • Ensure Block enumeration of local users on domain-joined computers is Enabled.
    • Ensure Turn on convenience PIN sign-in is Disabled if your users do not use Windows Hello for Business, as it can interfere with standard domain password caching. [1, 2, 3, 4, 5]
  4. Clear the Local Token Cache If specific user profiles continue to break on the lock screen, their local cached Kerberos tickets might be corrupted. [1, 2]
  1. Have the user log into their desktop via the "Other User" workaround.
  2. Open Command Prompt and type: klist purge
  3. This clears out their locally cached tickets and forces the computer to pull fresh authentication parameters from the Domain Controller the next time they lock and unlock the machine. [1, 2]
  To help narrow down the fastest fix, could you let me know:
  • Do your users log in using their email address format (UPN) or the traditional DOMAIN\username (sAMAccountName) format?
  • Is forcing the "Other User" blank login screen via GPO an acceptable permanent solution for these shared terminals?