Hide the last logon in Windows 2000 Professional

by Jim Boyce | Mar 26, 2007 8:00:00 AM

Tags: Jim Boyce, user name, Microsoft Windows 2000, Microsoft Windows 2000 Professional, security, Microsoft Windows, Windows 2000 Professional Tips Newsletter

3 comment(s)

Takeaway: Don't unwittingly open yourself up to a security breach—ensure a blank slate each time you log in to Windows 2000 Professional by hiding your user name altogether. Here's a simple way to tighten security in Windows.

By default, Windows 2000 automatically shows in the logon dialog box the user name of the account last used to log on to the computer. This saves the time and trouble of typing the user name for every logon, which is convenient if there's only one person using the computer or if someone uses it more frequently than anyone else.

Since you need an account as well as a password to log on, displaying the user name isn't a security risk per se, but it can weaken security in environments where security is critical. After all, knowing a valid account name is half the battle in hacking into a system. The solution? Hide the last logon from the dialog box, forcing the user to type the user name each time he or she logs on.

You hide the user name by defining a security policy setting. You can define the setting locally or inherit the setting through the domain security policy. If the policy is defined at both locations, the domain policy takes precedence and overrides local policy. Here's how to hide the user name:

Open the Administrative Tools folder in the Control Panel and then open the Local Security Policy object.
Expand the Local Policies/Security Options branch. Double-click the setting Do Not Display Last User Name In Logon Screen.
Click Enabled, then click OK and close the Local Security Settings console. The change will take effect at the next logon.