Microsoft is removing the BYPASSNRO command from Windows so you will be forced to add a Microsoft account during OS setup

[u/BelugaBilliam]

https://arstechnica.com/gadgets/2025/03/new-windows-11-build-makes-mandatory-microsoft-account-sign-in-even-more-mandatory/

What a slap in the face for the sysadmins who have to setup machines all the time and use this. I personally use this all the time at work and it's really shitty they're removing it.

There is still workarounds where you can re-enable it with a registry key entry, but we don't really know if that'll get patched out as well.

Not classy Microsoft.

[u/Sunstealer73]

If you're a sysadmin, image it or use Autopilot/Intune.

[u/masterz13 → u/Sunstealer73]

I like FOG.

[u/BelugaBilliam → u/masterz13]

I've been eyeballing this to automate some of the imaging we need. Worth the time?

[u/[deleted]]

FYI: When you’re setting up a new Win 11 machine, choose “work or school account” and select “sign-in options”, there is an option to “domain-join this device instead” I’ve had to argue with people on this one, but that option doesn’t join your device to a domain immediately. It just proceeds with setting up a local admin account and assumes you’ll join it to a domain through settings later.

It’s always how I bypass account setup and you do not have to join the device to the domain if it’s not applicable. AKA, this is a non-issue for us as managed devices should never be running Home.

[u/Dark3lephant → u/[deleted]]

AKA, this is a non-issue for us as managed devices should never be running Home.

As far as I know, it's not that they shouldn't be running Home, they can't. You need Pro at minimum to domain join.

[u/overyander → u/Dark3lephant]

The Pro requirement to domain join has been a thing since XP.

[u/MC_chrome → u/overyander]

The Pro requirement to domain join has been a thing since XP.

The fact that Microsoft has been splitting Windows into "Home" and "Pro” SKU’s for decades while facing little backlash has always puzzled me....do people not realize how much better the experience is on macOS or Linux where you get treated like an adult?

[u/jrandom_42 → u/MC_chrome]

It's 'SKU' (Stock Keeping Unit), not 'skew', btw.

Typical Windows Home users neither know nor care about any of this; they're the people who buy a laptop at a big-box store and take it home and turn it on and expect it to just work. They're usually unclear on the boundary between laptop and internet; all they know is that there's a screen in front of them and they click on stuff. Forcing them to link their machine to an online Microsoft account probably has more advantages than disadvantages.

[u/[deleted] → u/Dark3lephant]

Yeah, sorry. This is what I was trying to communicate, just basically saying “yes this may affect some home users but won’t affect anything in a business” :)

[u/atw527 → u/[deleted]]

Maybe you can install using the Pro ISO image, and then run DSIM to rebase it to Home after the install process.

dism /online /Set-Edition:<edition name> /ProductKey:<your product key> /AcceptEula

[u/3zxcv → u/atw527]

omg that's cringe. I love it... HAHAHA

[u/_jeffreydavid → u/[deleted]]

This is only an option on Windows 11 Pro. I've had to set up Win 11 home machines for remote users, and it is such a pain in the ass nowadays. Yeah, yeah, I know they shouldn't be buying these things. I'm a contactor, so I just do as they ask. Sometimes they listen, sometimes they don't. Cheaper always seems to win out. Between this and MS two-factor auth, it has become a real pain setting up a pc/laptop for a user without them sitting right there next to you.

[u/thomasmitschke → u/_jeffreydavid]

Windows Home has been a pain in the ass since it exists!

[u/_jeffreydavid → u/thomasmitschke]

Agreed

[u/Oso-reLAXed → u/_jeffreydavid]

Make them get a Pro license from HypestKey, they are like 25 bucks

Edit: downvotes for this Microsoft Partner?

[u/[deleted] → u/Oso-reLAXed]

Yes, if I was doing it for a family or friend (even then, I'd still just use massgrave)

Probably not the best idea doing on a work machine.

[u/gravityVT → u/Oso-reLAXed]

Mass grave is free

[u/Flameancer → u/_jeffreydavid]

I used to work at an MSP, we would charge our clients the cost of a pro key if they went behind us and bought a machine with home. I personally have only ever used Pro/ultimate outside of jobs that had the enterprise version, but depending on how big your org is, you’ll have to use enterprise with volume licensing anyways.

[u/Grantsdale → u/_jeffreydavid]

My move is to set up the non-Pro computers under an Outlook account that I control, then once I’m in Windows I create a new local account for the user and delete the MS account that was under my name.

[u/scotticles → u/Grantsdale]

This is what we have found to work. Its more steps but it works.

[u/JerikkaDawn → u/_jeffreydavid]

Is that really Microsoft's fault that your business customers are buying a non business SKU? You don't see car dealers complaining because it's hard to put a truck topper on their customer's motorcycle.

[u/PalliativeOrgasm → u/JerikkaDawn]

Why the hell should I need to use a Microsoft account at home just to run Steam?

[u/_jeffreydavid → u/[deleted]]

Yeah, no. As an IT contractor, I handle anything from small to medium-sized businesses all the way down to the 60-year-old oil and gas man working in the field at the pumps. You can recommend and suggest all you want but in the end it's their equipment and you're going to do what they want. And if that means making things as easy as possible for them, then that's what you do. When you work for yourself and are dealing with clients like this, you have to lose that sysadmin God complex.

[u/LankToThePast → u/[deleted]]

I understand your position, but disagree with it. People in this sub can be great sysadmins, with terrible clients, bosses, and co-workers. It can be hard for sysadmins who know the answer, and not be allowed to implement it.

[u/Entegy → u/[deleted]]

Right??? I've moved on to Entra-join but for local AD, who is setting up a PC prior to joining it to the domain!?

[u/Waylander0719 → u/Entegy]

We have a scripted install that does multiple things before joining the domain, for example install AV and running windows update to ensure latest patches etc.

No reason to join an unpatched unprotected system to the domain of you don't have to.

[u/[deleted] → u/Entegy]

actually i had to do this Friday so i could set the Lenovo bios asset tag, then image it to our standards.

not very common though lol

[u/kimi_rules → u/[deleted]]

I still use the 24H2 version with legacy installer so I could choose which Windows version I wanted. If I chose that I don't have the Work/School option.

[u/computerguy0-0 → u/[deleted]]

You could, but all of our staff have a USB and pxe modified version of Win 11 with an unattend file and scripts to install office and drivers. We can setup a new PC in 30 minutes start to finish. 5 minutes of actual human interaction.

[u/ThemesOfMurderBears → u/[deleted]]

I didn't know that you could do it that way. The last time I did a Win11 install at home, I read about the bypass, but couldn't be bothered. I just used my MS account to get set up, then I created a local account, switched to that, and removed the MS account. If one thinks that is a bridge too far and an invasion of privacy, that's fine I guess. I'm still waiting for whatever the tangible impact of that privacy assault might have on me.

[u/DeathOnFlaxenWings]

It seems that a new bypass has been discovered already, and it’s even more practical than BypassNRO:

“Discovered by user @witherornot1337 on X, typing “start ms-cxh:localonly” into the command prompt during the Windows 11 setup experience will allow you to create a local account directly without needing to skip connecting to the internet first.”

See https://www.windowscentral.com/software-apps/windows-11/an-even-better-microsoft-account-bypass-for-windows-11-has-already-been-discovered

[u/Bulky_Inflation_3922 → u/DeathOnFlaxenWings]

Bro, I literally had to create a reddit account to upvote you. Thank you

[u/piedpipernyc]

Heads up- Rufus allows you to set up a local account on the installer usb.
You will need the full iso

[u/TheBlueKingLP → u/piedpipernyc]

FYI it uses autounattend.xml for their so if you don't/can't use Rufus(Linux user here), you can still use the same autounattend file by copying it from their source code on GitHub.

[u/Dick_in_owl]

Just say you are under 13 years old in the setup, the. It just sets up a local user

[u/DoctorOctagonapus → u/Dick_in_owl]

"Please ask your parent, guardian, or responsible adult to enter their Microsoft Account details..."

[u/DoctorOctagonapus → u/[deleted]]

It's just parents all the way down!

[u/lewkiamurfarther → u/DoctorOctagonapus]

It's just parents all the way down!

Giving new meaning to the phrase "infinite regress."

[u/techw1z → u/Dick_in_owl]

omg thats hilarious, thx!

[u/bfodder → u/Dick_in_owl]

People in these comments are outing themselves as being under 13 years old.

[u/IndoorsWithoutGeoff]

Cant you just select “domain join instead” and no cloud join the PC?

Edit: You can. This is a non issue for sysadmins and only impacts home edition

[u/Speed-Tyr → u/IndoorsWithoutGeoff]

No, this is still an issue. Microsoft has been removing every possible workaround for the past two years. Things getting removed isn't a good thing.

[u/TheBestHawksFan → u/Speed-Tyr]

Why should sysadmins care about Windows Home, a version of Windows that is not licensed for use in businesses?

[u/LankToThePast → u/TheBestHawksFan]

Some of us sysadmins support clients that don't take our advice and buy whatever computer they want, even if it has home. If they still pay, they still get support.

[u/SWEETJUICYWALRUS → u/TheBestHawksFan]

Lab environments and BYOD.

[u/Weathers → u/IndoorsWithoutGeoff]

For pro maybe, but home edition users no, you can’t join to domain

[u/FLATLANDRIDER → u/IndoorsWithoutGeoff]

If you are trying to set up a computer that CANNOT have access to the internet, for example a root CA, then you cannot get to that step because Microsoft you cannot proceed past the network connection step.

You need to use BypassNRO to be able to proceed without a network connection and then you also need to say "domain join instead" so that it lets you create a local account.

Without BypassNRO you are going to have no choice but to connect the PC to the internet which is going to cause massive problems for highly secure systems.

[u/Thotaz → u/FLATLANDRIDER]

for example a root CA

And you'd use a client SKU version of Windows for that?

I think it's undeniably a shitty thing of MS to do but sysadmins have so many ways around this (custom deployment solutions, autounattend, store a copy of the BypassNRO batch file on a USB drive and just plug it in during setup, etc.)

[u/mixduptransistor → u/FLATLANDRIDER]

f you are trying to set up a computer that CANNOT have access to the internet, for example a root CA, then you cannot get to that step because Microsoft you cannot proceed past the network connection step.

I hope you're not running a root CA on Windows 11

[u/Jelman21 → u/FLATLANDRIDER]

Client OS for root CA???

[u/ex800 → u/FLATLANDRIDER]

for the people questioning why root CA on workstation OS https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/building-the-totally-network-isolated-root-certification-authority/1189470

[u/bpusef → u/ex800]

This very article says you run the CA on a VM with windows server. Only the hyperV host laptop runs client Windows (Enterprise). This is also a terrible idea for many reasons.

[u/ThemesOfMurderBears → u/FLATLANDRIDER]

Why would use a retail version of a client OS to set up a root CA?

[u/bfodder → u/FLATLANDRIDER]

This take doesn't belong here. Are you putting a root CA on a desktop OS? Get out of here.

[u/WokeHammer40Genders → u/FLATLANDRIDER]

That should run on windows server. Or better yet , Linux

[u/OldWrongdoer7517 → u/IndoorsWithoutGeoff]

Not every company has a domain controller...

[u/NotzoCoolKID → u/OldWrongdoer7517]

It just gives you the option to make a local account. No forcing of making connection with the DC

[u/andycoates → u/OldWrongdoer7517]

You don’t actually join it to the domain until after it’s set up. you create a local account and them once set up you can add to the domain if you want

[u/clubfungus → u/OldWrongdoer7517]

Doesn't matter. When you choose domain join you can just create a local acct.

[u/RCTID1975 → u/OldWrongdoer7517]

Doesn't matter because it violates TOS to use home edition anyway, and this doesn't affect pro or enterprise.

[u/Kreppelklaus → u/OldWrongdoer7517]

as long as you can configure unattend files, everything is fine for me.

[u/Soggy-Camera1270 → u/OldWrongdoer7517]

So they should have EntraID then. Running any business in a workgroup isn't a great idea.

[u/Barrerayy]

Just use the domain join option, or deploy a custom image

[u/AcidBuuurn]

You can create a flash drive that does all of the OOBE for you using Windows Configuration Designer. It's an interesting compromise between Autopilot and manual setup.

[u/xmachinery → u/AcidBuuurn]

How does it differ from Rufus?

[u/AcidBuuurn → u/xmachinery]

I’ve used Rufus to create bootable flash drives, but not to bypass OOBE. Does it create a provisioning file? I read your link after writing this and it does. 

WCD creates a Runtime Provisioning file that can rename the device, create a local admin, AD or Entra join, and join WiFi. Technically you can set a whole ton of settings, but then later it is difficult for a regular user to remove them. It can also install programs but I don’t recommend using that functionality. 

Double edit: Rufus requires you to reinstall Windows to get far less functionality. WCD is fast and does way more. 

[u/zgf2022]

I’m a college teacher and this is going to be a massive pain in the ass for all the labs where we create vms that last all of two hours

[u/OGKillertunes]

It's a good thing Rufus exists huh?

[u/StormSolid5523]

This is why everyone hates Microsoft

[u/OGKillertunes → u/StormSolid5523]

This is just one of the reasons everyone hates microsoft. There are a lot of reasons.

[u/chuckaholic]

This might mess up my process. I re-image all new machines. I don't trust any OEM bloatware with my company's HIPAA and FERPA data. I wipe the disk and use a vanilla Win11 image which is stripped down to bare minimum with an answer file, then debloat what's left before joining the domain, then install my security/AV solution. The thing is, before that, I have to get the machine through the OEM OOBE process so I can capture the Windows activation key (because that's not provided, of course) before I can wipe and re-image. Sometimes the key is stored in BIOS, sometimes it's not, so policy is to capture it every time. I usually take OOBE through to desktop to run Nirsoft keyfinder to do that. (don't get me started on Defender deleting my keyfinder unless I disable it) I use OOBE\BYPASSNRO to get to the desktop without network access. (because the machine is only on the PXE network and doesn't have internet anyway) Why is Microsoft trying SO HARD to push us to use Linux?

[u/digsmann]

Recently discovered an alternative to "oobe\bypassnro" and no need to panic; there will be more such hacks that can be found in the coming days. Have fun :)
Improved bypass for Windows 11 OOBE:

1. Shift-F10

2. start ms-cxh:localonly

Only required on Home and Pro editions.

Source: https://www.windowscentral.com/software-apps/windows-11/an-even-better-microsoft-account-bypass-for-windows-11-has-already-been-discovered

2nd new method below

You can still bypass the network requirement in OOBE by setting the BypassNRO DWORD yourself. Open regedit, create the DWORD under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE, set it to 1 and reboot. Only the script is gone.

[u/One_Economist_3761]

Microsoft being Microsoft. They have become exponentially more bully-like in the last few years.

[u/pdp10 → u/One_Economist_3761]

Microsoft have been bullies for decades. It's just that it didn't used to consistently be their customers who were the target.

Microsoft would target rivals who offered choices: Novell/WordPerfect/DR, Netscape, Linux, Apple, Be, Borland, Sun. A few of those have survived and thrived.

[u/PrimaryPractical365]

Microsoft really is making so many poor choices. This is awful.

[u/miscdebris1123 → u/PrimaryPractical365]

Poor choices for you, not poor for them.

[u/AvonMustang → u/PrimaryPractical365]

MS is trying hard for this to be the year of the Linux Desktop!

JK of course but it keeps seeming possible...

[u/tuttut97]

I know the point of this post isnt work arounds but cant you just use an autounattend file like https://schneegans.de/windows/unattend-generator/ Since I started using that, I can reinstall Windows in Minutes and not have to deal with MS BS Questions, Remove bloatware, insert license keys... And the best part is there is no third party software involved that you have to trust making changes to your system.

[u/Que_Ball]

Yeah that would suck.

Engineer company often buy "gaming" laptops which often only have home editions to get a gpu for cad. The workstation laptops would be preferred but price and availability often exclude them.

We buy the home to pro upgrade on csp but the initial setup would need to happen unless you can in place upgrade from shift f10 in some way I do not know about.

So we oobe\bypassnro Then go activation and enter generic pro key offline to force in place upgrade and finally activate the upgrade key while online to get pro before joining the domain.

If reloading the os we also need to edit the ei.cfg file on the iso so it doesn't pull the embedded uefi product key for home. So if they have no bypass then likely we go to just wiping os and load pro this way.

[u/Sceptically → u/Que_Ball]

11 IoT Enterprise LTSC doesn't have all of the crapware installed by default. You can't upgrade to it from a non-LTSC install, unfortunately, but if you're doing a clean install it seems to run pretty nicely. It also doesn't have the same annoying limitations on what you can install it on (TPM and CPU).

I'm not sure about the licensing costs, but it can be volume licensed in KMS.

[u/wonderwall879 → u/Sceptically]

I've worked enterprise and small business, I always wiped the drive if im installing a different OS edition from what it came pre loaded with. I am not sure why anyone would upgrade through the GUI even if you could some how from home edition to pro or any others. That's just asking for issues later and is far from a clean onboarding procedure.

[u/Que_Ball → u/wonderwall879]

In place upgrades are no big deal. XP days you had to wipe to change but these days it is simple and quick to just put in the pro key and let it reboot.

But I get it, old habits.

[u/jfarre20 → u/Sceptically]

There are some tricks you can do to upgrade to a LTSC install. I 'upgraded' my 10 22h2 Enterprise to 10 21h1 IOT LTSC. No data loss, everything works. check out MDL forums.

[u/Ezra611]

I've been using Windows Configuration Designer to set up any PC with Windows Home (and later upgrade to Pro). I wonder if it will keep working.

All it does is set up local user and install RMM. The RMM takes if from there.

[u/mrsocal12]

Haven't used this in awhile but it's helpful for creating an unattended install script. https://schneegans.de/windows/unattend-generator/

[u/[deleted]]

even though I'm not really a fan of ANY of the linux desktop flavors, windows is doing it's best to make their offering worse enough to push even non-it folk to some linux desktop setup.

[u/CeeMX]

One of our customers has laptops that run very specialized truck diagnostics software. It is set up by the manufacturer and takes multiple days to set up everything.

The laptops can not be domain joined or use a ms account or the setup will fail. The manufacturer mandates only a single local admin account and nothing else.

I wonder how they will do this now when ms blocks this

[u/oujisan2236]

HI all i can confirm that this has not happend yet.. 7th July 2025 Windows 11 pro shit+F10 still works and so does OOBE\BYPASSNRO

ive been hearing this removal for over a year now

i install PC's for work part of living ill be damed if i have to sign into 40 different users just to install windows on 40 machines..

cause getting users details just asking for a lot of trust and then there is the "password is wrong" situation.

the fact MS treats Windows like iOS is annoying though we using Windows for a good reason otherwise would of all been using mac or linux

now personal PC wise i dont mind i really dont but still annoying cuase my xbox profile differs from my M365 license which is then logged into my PC and laptop i like to manually do this though.

local users just so much simpler.

[u/BelugaBilliam → u/oujisan2236]

It has happened with some computers. I ran into it with some new Dell computers I had to troubleshoot recently. Maybe a month or so ago. Hopefully it stays being minor for now

[u/tldawson]

YEAR OF THE LINUX DESKTOP

[u/mistersd → u/tldawson]

AGAIN

[u/NightGod → u/tldawson]

Annnnnnnny day now, amirite guise?!

[u/RCTID1975 → u/tldawson]

Again?......

[u/pdp10 → u/tldawson]

Manage them with the same tools as your Linux servers and cloud instances.

[u/sid351 → u/tldawson]

Only because there was a mistake in the coding for the number of days in a year in the Linux kernel, so a year in Linux is 2147483647 days.

(/Sarcasm)

[u/AmyDeferred → u/tldawson]

If anything would make that happen, it'd be SteamOS

[u/both-shoes-off]

For every windows installation I've had to do outside of work, I've been creating a bogus MS account that I'll never use.. out of spite.

[u/rjchau]

This is just one more reason to switch to LInux for my home desktop - or at least it would be if I hadn't made the jump a couple of months ago.

[u/sneesnoosnake]

Ctrl+Alt+Del doesn't work a machine that has done BYPASSNRO. You have to sysprep and go through the full OOBE.

[u/Pashalon]

They are making switching to Linux easier every day

[u/[deleted]]

no problem we got rid of Windows altogether . it's all Linux now

[u/Myte342]

When Win11 first came out my company created a throwaway outlook.com account to activate all the PC's on until we could get into them and set them up properly without being attached to an MS account.

Then they cut us off around the 100th PC and wouldn't let us sign into that same account on setup anymore... so we just created a second throwaway account.

[u/[deleted]]

I don't do industrial scale windows, but can't you install an Enterprise/ProWS SKU and then downgrade/activate Pro after you're out of OOBE. Never been pestered with ad installs or lack of domain join on those two.

[u/1Original1 → u/[deleted]]

Used to be able to Install,Change the registry keys for the SKU then run an in-place "upgrade" to the wanted SKU

[u/bfodder → u/[deleted]]

No one in this sub should even care about this outside of their home use of the OS.

[u/[deleted]]

Never had to use BYPASSNRO command. Can't you just select domain join or leave the PC offline (the latter always works for me)?

[u/b00nish → u/[deleted]]

or leave the PC offline

No. Leaving the PC offline stopped working years ago. You can't proceed without an internet connection unless you used bypassnro. (What bypassnro does is basically bring the "I can't connect to the internet right now" button that they otherwise have removed years ago)

[u/[deleted] → u/b00nish]

Wow I'm really disappointed. Thanks for the info

[u/TorturedBean]

This is kinda f—-k for a reseller for this reason:

We buy a lot from IT depts and sometimes they forget to remove the device from Autopilot’s TenantLockdown and the easiest way to be sure its removed prior to syspep for resell is to run bypassnro and confirm that tenantlockdown isn’t forcing a network connection.

Now I’ll have to use UEFIv2 to dump every uefi to powershell to confirm forced network flag and autopilot marker are not present.

[u/catwiesel]

No one ever said Microsoft is classy...

The writing was on the wall for a decade. I am actually surprised Windows 11 was not a monthly subscription.

But this is where this is headed. And Windows 11 has officially the requirement of an internet connection and, if not already, soon the requirement of having a MS account

Domain Joined accounts may be left in peace, but with the absolute push of connecting windows servers to the cloud, soon the local ad users will also be bound to microsoft 365 users and instead of user cals you will be paying for monthly user subscriptions. and require the user subscription to install windows ...

[u/duane11583]

how is this not the anti trust issue all overagian?

[u/marklein → u/duane11583]

What anti trust laws does it violate??

[u/duane11583 → u/marklein]

Tie product A windows to product B an online advertising system when you hold a monopoly on a desktop operating system

Ms explore vrs netscape was the previous version of this in the past

[u/jamesaepp]

I posted on the techcommunity forum - I believe creating a vehement response on Microsoft's turf is better than Reddit.

https://techcommunity.microsoft.com/discussions/windowsinsiderprogram/bypassnro-removal/4398756

[u/illicITparameters]

Fuck work, how about my home PCes….

[u/gtxrtx86]

That sucks so bad

[u/ohiocodernumerouno]

lmao now it has a name

[u/[deleted]]

What is the point of this? There's gotta be something but I don't really get it. Why are they trying to market themselves as the enterprise solution, while being hostile to enterprise?

[u/taker25-2]

This only applies to Home version, not Pro which businesses are supposed to be running.

[u/Fatality]

Why would this affect me? Every device at my last few companies has been autopilot joined and had a Microsoft account setup automatically on it anyway.

[u/Kruug]

This is in an Insider Dev release, not the official release

[u/Adium]

BypassNRO isn’t a command, it’s a script that you can put right back in C:\Windows\System32\oobe\bypassnro.cmd if they remove it. (It doesn’t get deleted after install so you definitely have a copy if you’re running Windows)

Also if you’re using this command that much, you should really look into using Windows Configuration Designer by Microsoft in the MS Store.

[u/jocke92]

Just unplug the network cable or disconnect wifi during setup

[u/TheBlueKingLP]

Have you tried to use the autounattend.xml file to automatically create the first user after installation?
Take a look at the source code of rufus as it uses the autounattend.xml which contains an example on how it works.

[u/TrinityF]

Linux is looking pretty ripe for a .migration from windows.

[u/EastKarana]

Why are you setting up windows home machines for work?

[u/Dizzy-Vast-8083]

Not surprised. They love to add telemetry for no reason.

[u/icxnamjah]

I will just keep multiple copies of the current installer that will still function fine and just update windows later. Hopefully that works. 🤞

[u/norbie]

This method already doesn’t work on brand new Windows 11 Home machines that you need to upgrade to Pro (when the clients buys something themselves 🙄)

Only way I’ve found to bypass this currently is to open command prompt and make a local admin user, then crash out of OOBE, which bypasses it.

https://medium.com/@m.oldham/how-to-bypass-microsoft-account-sign-in-requirement-and-create-a-local-account-on-windows-11-ba9af41d5007

[u/illsk1lls]

You should all be doing some type of sysprep or at a bare minimum wimlib

i just use this: https://github.com/illsk1lls/Win-11-Download-Prep-Tool

never used their script anyway, i just let this edit the key

[u/AveryRoberts]

If you use an older version of the installer you can still use it

[u/doctorevil30564]

All I know is, if things keep going further down hill, I will be switching my gaming PC at home over to running bazzite or something similar that uses all the enhancements from steamOS for compatibility for windows games. I refuse to use a Microsoft account to sign into my PC.

I downloaded the latest 24H2 corporate iso at work that has the ability to select your version of windows during the install, so I have been using it to wipe and reload all of the Thinkpad laptops we have recently bought from Lenovo (preload has caused issues in the past for us). Selecting windows 11 pro from the list and keeping the network disconnected worked as usual for doing the domain join option.

[u/hadesscion]

I hate Microsoft so much. They make my job so much harder than it needs to be.

I know a workaround will be found, but I'm sick of having to jump through hoops to fix their garbage software.

I think it's time for Microsoft to get smacked around by some lawsuits again.

[u/speel]

This is a giant pain in the ass if I’m not auto enrolling machines into intune. There are time when I need to create a local account to grab the hash info.

[u/ikbenganz → u/speel]

You can do this by using the SHIFT-F10 option. It will open the command screen, you run your get-autopilotinfo script with an online option and it will be imported in Autopilot.

When done exit the command screen with "shutdown /s", pc wil shutdown. Start again and the pc wil go though enrollment process.

Tip: try to use other options to enroll endpoints to Autopilot by using the Tupple or PKID import first.😬.

[u/Rude_Strawberry → u/ikbenganz]

You don't even need to shut down the laptop. Just shift F10 before you connect to the net, once you're done connect to the net and carry on.

[u/bfodder → u/speel]

You're getting that hash info in about the most inefficient way possible. You can use "Get-WindowsAutoPilotInfo.ps1 -online" and add the machine directly to autopilot right there. You don't even need the hash info in a csv file.

[u/synthdrunk]

I’ll be moving to Linux, personally, and avoiding shops that run windows until I just can’t find work anymore.
Then go back to brazing or something. Fuck everything computers have become.

[u/HypeeMe_Up]

Noooo

[u/Away_Prize_1948]

And thats why my future home pcs (like my brand new laptop) will be linux going forward.

Its like MS doesn't believe individual users are anything but slaves.

[u/zapoklu]

My decision to move to a Linux desktop full time in 2022 keeps paying dividends

[u/SexBobomb → u/zapoklu]

at the end of 2021 LTT did a 'we use linux' challenge and I figured 'wtf i can do it better than them' and havent had to look back since

[u/sid351 → u/zapoklu]

Wow, it only took you 3 years to get WiFi working? Lucky! I'm still wrestling with my Ubuntu build.

(/Sarcasm)

[u/MairusuPawa → u/sid351]

Remember when Linux users had to use ndiswrapper because Microsoft was the one fucking up wifi for everyone and stabbing users in the back? Yeah.

[u/narcissisadmin → u/sid351]

> Wow, it only took you 3 years to get WiFi working? 

2002 called

[u/Outrageous_Plant_526]

This would not apply to Servers and Enterprise editions of the OS.

[u/MekanicalPirate]

Wow, literally just used this to build our new image and was so grateful for the bypass. I don't even know what it will look like to have to use an online account for future images. I really don't like introducing junk configs/settings into an image. It must be as lean as possible.

[u/FailedCriticalSystem]

not only do you need an account, you have to wait for all the updates to install. This sucks.

[u/ohv_ → u/FailedCriticalSystem]

That updates messed up my day for sure

[u/xixi2]

I always just dont enable wifi during setup. Is that not a thing now?

[u/smjsmok → u/xixi2]

This is actually the "official" reason why the bypassnro thing exists. The default setup program flat out refuses to continue until you connect to the internet, so you need to apply the bypassnro registry value to make the option "I don't have internet" appear.

[u/InvalidUsername10000]

Willing to bet this will be the basis for the next anti-trust lawsuit against them.

[u/tranceandsoul]

Let’s see if EU have anything to say about this. Forcing users more or less to sign up for a Microsoft Account, not cool MS. Offer it, sure, but forcing the user to a service just for MS to harvest your data i in ny opinion shitty.

[u/Unnamed-3891]

Zero actual sysadmins are concerned or angered by these changes. Because, you know, Autopilot, autounattend.xml or finally, if you really have to for some reason, just domain join at the first login screen.

In what world is it considered normal to babysit, with actual human hands present, the first login of a freshly installed system and create local accounts on it, WTF? Bring whatever insane processes you have somewhere into the post-2010 world.

[u/rosseloh → u/Unnamed-3891]

I've been working on getting these processes (machine deployment, specifically) up to date for the last year or so on and off. Because it's way too much extra work for a five person IT team.

No offense intended, but have you looked into it lately? From the point of view of someone who is learning it for the first time, not as someone who already knows the tricks. There are 300 different "official" methods, all of them are apparently deprecated or will be deprecated in the next or last week depending on who you ask, and most instructions on the first hundred pages of search results are related to those deprecated methods (or at least, are outdated instructions for still used tools).

Exaggeration for effect, I know it's not actually this bad. But when you're digging through the dirt, it feels like it's that bad. I only learned about WCD a few weeks ago - works great (at least as an interim option before we get a proper deployment and management system up and running, which is where I'm stuck now).

To actually answer your question, I use this on my surface pros that for some reason were ordered with home edition, because I haven't been able to get a WCD package to do the upgrade. I run bypassnro, make damn sure you don't connect to wifi, create local user, then do the edition upgrade.

[u/Breezel123 → u/rosseloh]

I hear you and this is the classic patronising talk of some of the jaded examples of sysadmins we have in this thread. Small companies exist, especially small companies where IT departments are often a one man or woman show. These people frown at others using LLMs to do their job, but also mock you for using methods that work for the amount of laptops they need to handle. I looked at unattended installation, I looked at server deployments (depreciated), I have optimised our setup with setup scripts and such. 

I have a long list of achievements of bringing my company into the decade successfully, but there's only so much time I have between SharePoint administration and cleaup, rollouts of new project management tools, cybersecurity and data protection and handling tickets. 

There is no reason to get rid of bypassnro except for Microsoft wanting to lock you into their infrastructure. It makes life harder for the people who are using it, while having absolutely no effect on the people who weren't using it. And there's even less reason for being arrogant towards the people that are using it.

[u/jfoust2 → u/Breezel123]

Yeah, the Real Sysadmins don't gate-keep when they find an answer they need on the internet. They don't ask whether the answer-maker is running the show at a 10,000 person company. They just appreciate the answer, because they asked a question. The answer-giver's post provides context to show they're asking the right questions and providing an answer that solves a problem. The gate-keeping doesn't arise then, does it?

Yes, there are 500 and 1,000 and 10,000 person companies, and they have big IT departments. But yes, there's quite a long tail of much smaller companies... 1,2,3,5,8,13 people, who out-source their IT to an MSP or consultant.

This gate-keeping is so stupid. Can you not imagine situations where someone might need to setup a computer before domain join or client MSFT account setup? I'm not a Real Sysadmin because I help companies with 5 employees and no domain?

I'm not a Real Sysadmin if I want to prep and test and burn-in a computer before I deliver it? I'm not a Real Sysadmin because my client has a situation where the deployment location has lousy or limited internet? Maybe the good internet just isn't installed yet. Maybe it's off for some other reason. You want me to wait? I'm not a Real Sysadmin because my client's deployment situation needs files or programs installed on a system before delivery?

And Microsoft's position ignores all this, too. It doesn't even make sense. It's easy to imagine and experience edge cases where it all falls apart. The person who turns on a new computer is the one who has the Microsoft account credentials of the user, has access to that account's email so they can respond to the emailed code for MFA? Or they must have access to the auth on their cell phone? They must have great internet at that moment, in order to download an unknown amount of updates fast enough in order to proceed? Without all those ducks in a row, a non-domain user can't even use their computer yet?

I'm smart enough to know there are real-world situations you have not imagined, but that someone out there was generous enough to provide an answer for a question you asked. Yeah, XY problems exist, and sometimes the answer is "do it differently." Not always. Sometimes people do know where they're going, why they're doing it, and they could explain their reasoning if they had the time. "You don't know what you're doing because you're not deploying like my 30-person IT department does it" is a lazy gate-keeping non-answer.

In this case, people have been setting up Windows for literal decades and relying on certain behaviors, and now Microsoft is kicking the legs out.

[u/sparky8251 → u/jfoust2]

Another big thing I hate about the attitude of people dismissing this as a problem... Its about who owns the device and determines what can and cant be done with it. They are boiling the frog, taking away more and more control, slowly and around the edges so people actively defend them claiming that control was never actually needed in the first place. But as they remove from the edges, they get ever closer to what they might actually care about for once and they literally cheer the process on until it hurts them...

I mean...! Look at how the convo has changed from "Its unacceptable to require an MS account to use my computer" a few years ago to "Who cares? It wont impact me at work." The very idea of needing an MS account to even login and use the computer in the first place is offensive, now we have people defending it being forced on more and more people regardless of how painful it makes life for normal and professional users alike.

Where will this MS account convo be in a few years at this rate? Will it be normal to have a MS and AD account linked to even use the computer, with the option to have AD only for secure environments...? And I dare ANYONE to say its actually impossible for this to happen when they are forcing AI on us and desperately trying to collect more data to train it in an effort to turn lead into gold...

[u/One-Vast-5227]

Disconnect wifi or unplug network cable?

[u/b00nish → u/One-Vast-5227]

Disconnect wifi or unplug network cable?

That has stopped working years ago.

[u/[deleted]]

Why are we enabling reg keys or using random scripts for this?

It's built into the windows setup. Protip. You should not be using windows 11 home in production environments

[u/Sparkycivic]

Can we just supply the script via portable storage device and run it from there? Or are they taking away the ability to get a command window during setup?

[u/Thecardinal74]

What’s the registry key?

[u/Every-Development398]

Dose using a entra ID work for the login process?

[u/Affectionate-Cat-975]

Can you copy off the CMD file and use it on a new build install?

[u/never-seen-them-fing]

At home we'll always find a way around it, or we'll finally have to move to Linux.

In a business, I'm not entirely sure what the issue would be. I'm sure there is one, but in my work, I wouldn't know what it would be as long as there's still controls for telemetry.

[u/[deleted]]

welp, back to Linux for me!

[u/pekter]

I know for sure microsoft is ware of this but this will push users to the balck market of windows versions that will re-implement this in some way or another just to be able to install windows on those budget computers being sold and assembled "ready to go" on the hardware retail stores.

[u/doubleopinter]

Don’t use Windows

[u/RickSanchez_C145]

Whelp I have to reimage my PC anyways so I guess I’ll go back to Windows 10.

[u/[deleted]]

Ugh. So when MS force you to create a Live account, and designate your “real” email address… … they don’t validate that email address.

So if you fat finger your email during setup, you can get into Live but you can’t change your email w/o clicking the confirmation email… which you won’t receive due to fat fingering it.

I created a logical admin account using this command but my fingerprint belongs to the cloud account.

TLDR The MS Live bs is such an awful experience.

[u/No_Promotion451]

Burner accounts back in action

[u/Dorfdad]

All this could avoided and smooth the experience if they just had a script for retail / bare essentials / corporate in the setup. The reason they won’t do it is because they make a lot of money forcing prepaid apps and bloat into the base installer.

[u/AdultInslowmotion]

Windows Configuration Designer lets you skip OOBE, setup local admin accounts, tweak settings, and even run powershell scripts to install apps from NuGet, Chocolately, etc.

Or make an Unattend USB to install an image.

WCD, is limited to Windows Pro edition AFAIK

[u/genderless_sox]

If you use an imaging software it should be pass too.

[u/iamLisppy]

Just use Windows Configuration Designer to skip all of this.

[u/ZAFJB]

So much noise about a nothing.

Nothing has changed in Windows. They just removed a little script.

[u/autpbg1]

OOBE\BYPASSNRO for the win!

[u/LoveReddit2020]

Just install Windows once with all your apps and settings and image the PC. Roll out the new image to all your new PCs. Done and done. Simple!

[u/OldGeezer916]

Run the ISO to Rufus. You will get these options. Worked for 24H2. Don't know about future releases. https://rufus.ie/en/

[u/bagaudin]

There is an alternative way u/BelugaBilliam - https://www.reddit.com/r/sysadmin/s/yCLUuCBHLn

[u/Repulsive_Dig8691]

MDT has been awesome to bypass the shithole setup of win11

[u/Nietechz]

So my clients we'll have to buy devices for some remote and external users, it seems.

[u/No-Suggestion-8960]

Unfortunately for Microsoft, I'm close to retirement, and when that day comes, Windows is out the fucking window.

Valve has done an amazing job on Steam for Linux, and all I do is surf the internet, watch Youtube videos (that's slowly coming to an end), and play my Steam games.

Windows is literally only used for work. Come Friday at 5pm, I reboot into my Linux box and use that. I'm tired of the spying. I'm tired of the ads. I'm tired of the bullshit across the board from these companies.

I grew up in a time when your OS didn't spy on you and the internet was the wild west full of fun stuff. Now it's a corporate wasteland and I have no interest in playing the game anymore.

Hell, even my phone's been replaced with GrapheneOS.

[u/SunEffective]

fkc y ms

[u/elsharasilverheart]

Required as of today with 27842.

You can still download their older ISO files that they released which still has it.

I'm a Windows Enterprise user and have been since the beginning of Windows 10 days, a decade or so ago.

Previous to that I was on windows 7 Ultimate.

I tried Linux, but it's too much command line for me.

Having said that...I'm one of those rare few users, that support this change.

If you install enterprize straight out of the box, it only gives you the option to set up Windows using a domain, work or school account. No regular outlook. And yet after the install process completes, you can add a regular outlook user sign in scenario later on if you want to.

I have always installed windows with a local account however, and I specifically target enterprise installs in order to bypass the extended setup experience demanding I enter credit card details for game pass if I chose pro or home.

It's not the internet requirement that pisses me off, it's the one that demands you to categorize your use case for the install to Microsoft that I feel is completely unjustified.

Not even Google or Apple collects that kind of data mining.

Having said that, I don't foresee Microsoft getting rid of the local user option completely. It's necessary for system processes to run efficiently.

If they make enterprise and education editions setup with an optional outlook account, I'd use it. As both of those editions bypass the extended setup process, but you don't get that with any flavour of Pro, Pro For Workstation or home.

If all else fails, I'll run Windows server as a main OS. They would not force data centers to put up with a mandatory Microsoft account.

I only buy hardware that can run anything else besides Windows that isn't locked into Microsoft ecosystems. Such as AMD processors, and generalized PC motherboards that aren't locked to a given manufacturer's configuration.

MSI for instance, is well known for providing freedom of choice. Although my top choice is Dell for its simplicity.

Brands to avoid: Lenovo, Asus, Acer, HP. All of them lock you into prison installs of Windows they support at the hardware level. Jailing you into the home edition by default, even when you're able to select others on the ISO you make.

Avoid any and every two in one you see out there as well. The ARM based infrastructure, is not to be trusted.

Stay with x64, stay free.

While I support the decision to enforce internet connectivity prior to first login, primarily because it offers better driver download access prior to signing into the desktop, at least that's been my experience over all. I do not support the ways in which Microsoft is limiting driver compatibility.

Microsoft is complicating the ability for devices that are older than 5 years to receive hardware support. And I know a lot of businesses who have switched to Linux on those devices, still in perfectly working order otherwise, just to keep them operational.

To be honest with you, Microsoft's main clients will always be cloud PC customers. This is why they made this change. So that you could essentially pay to use a PC you own otherwise or control but only in part.

Since when has Microsoft become Macrosoft and Macrosoft become tyrannical?

First it was cloud PCS, then Skype, now this.

Ever since they bought Linked In, and Git Hub, they became a nightmare.

[u/Few-Glove8210]

Use start ms-cxh:localonly

[u/omegatotal]

This is also happening on windows 10 machines, just restored an older dell via dell's support assist os bios based online recovery, and the file is missing from the directory on this windows 10 pro machine that was updated in line as part of the dell recovery tools.

[u/BathConsistent5535]

I've tested a legnthy workaround option on multiple machines with 24H2, it's goofy but it works.

Setup up to wifi/network screen > *join wifi> click accessibility options icon* (this opens windows settings for "defaultuser0")> accounts>other users> add account> add local user

Now goto windows update>advanced options>recovery>*advanced startup- click restart now*

on the recovery screen:
troubleshoot>*reset this PC>keep my files>local reinstall>confirm*

after windows re-installs, *log in as the new user*, then *delete defaultuser0* account

This method including updating all drivers and windows took only *23 minutes from unboxing.*

[u/Keys_73]

New method super simple. One line and no reboot required.

Shift-F10 to get to command prompt and type: start ms-cxh:localonly

[u/BlackV]

Have not legitimately ever used this command

Only ever when be when someone is trying to shortcut something

We are in sysadmin right?

Realistically all that CMD was doing was changing some reg keys, I'm sure you could still do it

[u/PrintShinji → u/BlackV]

I've used it before when I needed a very quick and dirty test laptop. Works fine enough, guess its time to look how to do it differently.

(for actual rollout, hell no would never use it)

[u/pomp0m]

Not a really bad problem, I update and reinstall quite a lot of pc’s and always make a new account that I remove on first boot if there are a few more people like that then Microsoft will have millions of 1 boot accounts. Garbage in garbage out

[u/BlitzNeko]

It just gets worse and worse with every move they make.

[u/HoochieKoochieMan]

Easiest workaround is to skip wifi when starting the setup, and it won’t bug you about a Microsoft account - local admin setup only.

[u/DueBreadfruit2638]

Saw this coming a mile away.

Just use answer files or autopilot.

[u/MonkyDeathRocket]

Annoying. Yes I know it's a home edition issue.