Loading story…
Recent Windows 11 Home installation media and Insider build 29677 reportedly allow users to create a local account during the out-of-box experience (OOBE) while connected to the internet. Selecting the “Learn more” link beneath “Sign-in options” on the Microsoft-account sign-in page redirects setup to the local-user creation screen, according to testing on a fresh virtual machine and independent reporting.
The apparent loophole follows Microsoft’s efforts to remove prior account-requirement bypasses, including BypassNRO-related methods and ms-cxh local-account commands. It could simplify staging of test or loaner systems, but is likely an unintended behavior that Microsoft will remove in a future update; Windows 11 Pro domain-join options and custom deployment images remain separate supported alternatives.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Microsoft reportedly blocked known Windows 11 OOBE account-bypass techniques, including Registry-based BypassNRO, ms-cxh local-account commands, fake sign-in credentials, and oobenetworkconnectionflow.
Microsoft removed the oobe\bypassnro script, a method used to bypass the Microsoft-account requirement during Windows setup.
Bob Pony identified an apparent OOBE behavior in recent Windows 11 Home installation media: selecting the “Learn more” link under Microsoft-account sign-in options leads to the local-user creation screen. The behavior was reported to also work in Windows 11 Experimental Insider build 29677.
Windows President Pavan Davuluri identified OOBE quality and faster setup as Windows focus areas, without stating that Microsoft-account requirements would be removed.
Microsoft VP Scott Hanselman said he disliked the Windows Microsoft-account requirement and was working on the issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
MITRE ATT&CK documents **local account creation** as a common persistence technique under `T1136.001`, describing how threat groups and malware have created or enabled accounts on compromised Windows systems to maintain access and support lateral movement. Reported activity includes use of built-in commands such as `net user` to add accounts, sometimes followed by placement into privileged groups, with examples ranging from generic support-style usernames to attacker-controlled administrator accounts. Splunk published and later replaced a detection for this behavior that monitors endpoint process telemetry for `net.exe` or `net1.exe` creating local administrator accounts with the `/add` parameter and administrator-group keywords. The analytic, now superseded by **Windows Create Local Administrator Account Via Net**, is mapped to ATT&CK `T1136.001` and is intended to help defenders spot suspicious account creation, while noting that legitimate IT administration can generate false positives.
Aug 12, 2026
Microsoft confirmed that the Windows 11 cumulative update `KB5079473` is causing Microsoft account sign-in failures in several Microsoft applications, including **Teams, OneDrive, Edge, Excel, Word,** and **Microsoft 365 Copilot**. Affected users are shown a misleading message stating that the device is not connected to the Internet, even when connectivity is working, preventing normal sign-in activity across those services. The issue has been linked to a specific network connectivity state and appears to affect Windows 11 systems on versions **24H2** and **25H2** that use Microsoft accounts, while organizations authenticating with **Entra ID** are not impacted. Microsoft said it is developing a permanent fix and, in the meantime, recommends restarting affected PCs while they remain connected to the Internet, noting that the problem can return if a device is rebooted without an active connection.
Jun 29, 2026
Microsoft released the Windows 11 optional preview cumulative update **KB5074105** (for **Windows 11 24H2 and 25H2**) with multiple fixes and changes, including resolving a known issue where the **password sign-in option/icon could disappear** from lock screen sign-in options after installing updates dating back to the August 2025 preview update line. Affected users could still authenticate by hovering over the blank area where the password option should appear to reveal the hidden button; Microsoft reports the issue is addressed in KB5074105. The same KB5074105 preview update also introduces a local hardening change to reduce unauthorized interaction with sensitive system information by adding a **mandatory User Account Control (UAC) prompt** when accessing **Settings > System > Storage**. This change is intended to prevent non-admin users (or threat actors with local/remote access to a non-admin session) from viewing or manipulating detailed storage and temporary-file/system-file information without administrative approval, and is being rolled out as an optional “C-release” preview ahead of broader deployment.
Jun 29, 2026