3

One of the recommended methods for bypassing Microsoft account login during the Windows 11 OOBE is to attempt to log in using a locked account (no @thankyou.com being the most commonly recommended account to use). This would then allow Windows to be installed using a local account.

In various discussions on this general topic, there have been security concerns raised about using a locked account tied to the owner of a domain such as ‘thankyou.com’ (which in this case happens to be Citibank).

As suggested in a comment in this question, could the domain owner be granted privileges remotely over an OS installed this way? Is there some facility in the backend of Microsoft’s servers that would allow for an attack vector like this?

7
  • 2
    Viewed another way, if you sign up with a Gmail account, what prevents Gmail domain admins from taking control of your machine?
    – schroeder
    Nov 13, 2023 at 9:33
  • I think because there is a third party involved, a domain owner unaffiliated with Microsoft (or Google as per your analogy). Have I misunderstood your comment?
    – Brybeck
    Nov 13, 2023 at 9:35
  • thankyou.com is not from Microsoft either
    – schroeder
    Nov 13, 2023 at 9:47
  • I think that’s the problem as expressed by @Levente in the linked comment: A user is attempting to bypass login using a domain (thankyou.com) controlled by a third party. The login fails and the OOBE prompts the user to setup a local account. However, could there be something going on in the backend that still allows the domain owner privileges over the OS once it is set up with a local account?
    – Brybeck
    Nov 13, 2023 at 9:52
  • this just allows you to recover your activation key if you ever lose it and sync some things across computers. It won't allow any privileges over the OS, and I don't think they'd ever send an activation key or sync settings using any account but a live.com account. Nov 13, 2023 at 23:51

1 Answer 1

1

As far as I have looked into it (scanning the registry and various files after setup) it does not appear to store the initial locked email address and simply has the local users creds stored however there have been updates since I did this check and I do not remember the version i did it on. I performed the searches last year I think possibly around june but i could be wrong so this may have changed with an update ... it could also be the user creds for the online account attempt might have been stored as encrypted data somewhere or in a log file I didn't look in however these places should not grant local access through that email or domain.

the reason i performed the search was because this was an xray controller computer and so hippaa and all that which is also why I wanted a local only account so it wouldn't be uploading data to a one drive account (the default locations for folders like desktop picture docs etc. are now located in one drive by default). and more broadly limiting uploaded data to Microsoft as much as reasonably possible.

unfortunately i briefly looked through google and nothing seems to have anything on this particular subject and this of course is just my observations as an IT guy with over 20 years experience. However my background is not in data forensics. nor did I do a packet capture to see what data if any gets transmitted to microsofts servers or the locked email address that was used. however this would be such a massive security hole if microsoft allowed mistyped urls to gain access to your system. This issue would quickly lead to lawsuits and in some cases really big lawsuits.

1
  • 1
    just a note that you can disable OneDrive so that this doesn't happen. Feb 22 at 17:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .