1

One of the recommended methods for bypassing Microsoft account login during the Windows 11 OOBE is to attempt to log in using a locked account (no @thankyou.com being the most commonly recommended account to use). This would then allow Windows to be installed using a local account.

In various discussions on this general topic, there have been security concerns raised about using a locked account tied to the owner of a domain such as ‘thankyou.com’ (which in this case happens to be Citibank).

As suggested in a comment in this question, could the domain owner be granted privileges remotely over an OS installed this way? Is there some facility in the backend of Microsoft’s servers that would allow for an attack vector like this?

Improve this question
7
  • 1
    Viewed another way, if you sign up with a Gmail account, what prevents Gmail domain admins from taking control of your machine?
    – schroeder ♦
    Nov 13 at 9:33
  • I think because there is a third party involved, a domain owner unaffiliated with Microsoft (or Google as per your analogy). Have I misunderstood your comment?
    – Brybeck
    Nov 13 at 9:35
  • thankyou.com is not from Microsoft either
    – schroeder ♦
    Nov 13 at 9:47
  • I think that’s the problem as expressed by @Levente in the linked comment: A user is attempting to bypass login using a domain (thankyou.com) controlled by a third party. The login fails and the OOBE prompts the user to setup a local account. However, could there be something going on in the backend that still allows the domain owner privileges over the OS once it is set up with a local account?
    – Brybeck
    Nov 13 at 9:52
  • this just allows you to recover your activation key if you ever lose it and sync some things across computers. It won't allow any privileges over the OS, and I don't think they'd ever send an activation key or sync settings using any account but a live.com account.
    – pcalkins
    Nov 13 at 23:51

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .