Hide the last logon in Windows 2000 Professional

by Jim Boyce | Jun 18, 2007 12:00:00 AM

Tags: Jim Boyce, Windows 2000, Windows 2000 Professional, desktops, Windows 2000 Professional Tips Newsletter

Takeaway: If you aren't the only person using a Windows 2000 Professional machine, you can hide the last logon, which increases security and erases obvious evidence of previous users. Here's how to automatically clear the logon field.

By default, Windows 2000 Professional automatically shows in the logon dialog box the user name of the account last used to log on to the computer. This saves the time and trouble of typing the user name for every logon, which is convenient if there's only one person using the computer or if someone uses it more frequently than anyone else.

Since you need an account as well as a password to log on, displaying the user name isn't a security risk per se, but it can weaken security in environments where security is critical. After all, knowing a valid account name is half the battle in hacking into a system. The solution? Hide the last logon from the dialog box, forcing the user to type the user name each time he or she logs on.

You hide the user name by defining a security policy setting. You can define the setting locally or inherit the setting through the domain security policy. If the policy is defined at both locations, the domain policy takes precedence and overrides the local policy. Here's how:

Open the Administrative Tools folder in the Control Panel and then open the Local Security Policy object.
Expand the Local Policies/Security Options branch.
Double-click the setting Do Not Display Last User Name In Logon Screen.
Click Enabled, then click OK and close the Local Security Settings console.

The change will take effect at the next logon.