When switching users on Windows 11 domain joined PC at sign-in another users profile is accessed

Question

When switching users on Windows 11 domain joined PC at sign-in another users profile is accessed

Brent Baker 0

We are in a Hybrid AD/Entra domain with several Windows 11 Pro workstations that are used by multiple users. We have one user that when signing into a locked workstation with his account accesses the profile of the user that locked the workstation.

In this scenario USERA locks the workstation to go perform a task, USERB switches users and signs in with their account, but USERA session is opened with full access to their files, email etc... If the workstation us rebooted USERB signs in to their profile. USERB can walk up to any locked workstation in the facility and access the profile of any other user.

This is specific to USERB and we have been unable to replicate it with other accounts. They are not a privileged user.

This is extremely concerning.

0 comments

1 answer

Your answer

Answer 1

Hello @Brent Baker

That behavior is not expected. USERB successfully authenticating and then receiving USERA’s already logged-on desktop/session should be treated as a security issue until you identify the cause.

One thing worth checking first is the credential provider being used. Since Windows 10, Windows combines logon and unlock scenarios in its credential-provider architecture, and Microsoft specifically notes that credential providers must correctly handle the currently logged-on user/session.

Since this follows USERB across multiple PCs, I’d focus on what is unique to that account or its authentication method rather than a corrupted local profile. You can test the following:

Have USERB select Sign-in options > Password explicitly instead of PIN/Windows Hello/biometric and reproduce the issue.
Check whether any third-party credential provider, MFA/passwordless agent, SSO software, or security product is installed. Microsoft warns that third-party credential providers can cause problematic authentication behavior.
Check Event Viewer > Windows Logs > Security immediately after reproducing it. Correlate logon/unlock events such as 4624/4634/4647/4800/4801 and verify the Account Name, Logon ID, and Logon Type.
Run query user before and after the test to determine whether USERB gets a separate session or Windows is actually unlocking USERA’s existing session.
Compare USERB’s AD/Entra authentication methods and policies with a known-good user.

Also, Web Sign-in shouldn’t be involved here if these machines are Hybrid Entra joined. Microsoft states that Web Sign-in is supported on Microsoft Entra joined devices, not Hybrid Entra joined/domain-joined devices.

Given the security impact and the fact that USERB can reproduce this across multiple workstations, I’d open a Microsoft support case and provide the correlated Security log events. I wouldn’t consider deleting/recreating profiles a sufficient fix until you know whose credentials Windows is actually accepting to unlock USERA’s session.

Help make this community better for everyone: if this answer resolved your issue, please accept it or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution.