My new workplace laptop is configured so that after I log off and log on, rather than the last-logged-in user being selected by default, I have to hit ctrl-alt-del and then enter my username and password.
This seems like a security issue because I have 20 years of muscle memory built up around hitting Ctrl-Alt-Del and then immediately entering my password. (This is what I always did after either unlocking a machine that had been locked, or logging on to a machine that had my username selected by default because I was the last-logged-in user.) This means that I keep hitting Ctrl-Alt-Del and entering my password in the username field where someone shoulder surfing might see it.
To make matters worse, if I unlock the machine, I hit ctrl-alt-del and enter my password, but if the machine has been rebooted while I was away (to install updates, for example), I have to hit ctrl-alt-del and enter my username and then my password, which means I'm likely to do it wrong unless I always pay attention to whether I'm looking at the lock screen, or the logon screen. (An attacker might even power cycle the machine in order to bring up the logon screen instead of the lock screen, and then hang around waiting for me to hit Ctrl-Alt-Del and type my password into the username field out of habit. Or they might wait for a day when lots of people's machines have been rebooted due to an update, and then hover over as many people as possible to see if they do the same thing!)
So, for this reason, it seems worth recommending as a standard practice for individually assigned laptops to always have the last-logged-in user selected by default when you hit Ctrl-Alt-Del to log in. Am I missing something? If I am right, is this in fact documented as a standard best practice somewhere?
(Presumably, the point of the don't display-last-login feature is to reduce "information disclosure" to paranoid levels, such that even the next user of the machine doesn't know who the last user is. But I would argue that in the case of an individually assigned laptop, (1) 90% of the time, people know that the last-logged-in user was me anyway, and (2) if someone else used their account to log in to my laptop, I should have that information when I resume using my machine anyway. In either case, it doesn't seem to outweigh the potential risk of users typing their password into the username field where someone might see it.)
(Also, I know how to change it -- go to Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options and change "Interactive logon: Don't display last signed-in" from "Enabled" to "Disabled," but that's not what I'm asking.)