Windows 11: Known Local Account Loopholes     2026/10/05
Ami Sapphire

Last Updated: 2026/10/13

2026
[1013]
 - Apparently clicking on a 'Learn more' link bypassed Microsoft Account
   requirements, and I just found out that day...
 - Formatting consistency changes


 1. Closed Microsoft Account via email Loophole
    - This involved actually creating a Microsoft Account via email, closing
      the Microsoft Account, and using the formerly existing Microsoft Account
      when (re-)installing Windows 11. You are then told that you cannot sign
      in at this time and are then prompted to create a local account.
      * Patched: Windows 11 22H2(?) [It was patched... fast.]

 2. Disabling Network Access Oversight/Loophole
    - This involved setting up Windows on a machine without any Internet access.
      It will notice this and then prompt you to create a Local Account instead.
      * Patched: Windows 11 22H2(?) [Like the email one, it was patched... fast.]

 3. Set Up for Work or School/Domain Join Instead
 NOTE: This is for Pro - Does not exist for Home
    - During setup, choose 'Set Up for Work or School'
    - Click "Sign-in options" (subtle), then click Domain join instead
    - Variant: During Microsoft 365 signin, choose 'Domain join instead'
      * Patched: None

 4. OOBE Bypass NRO flag via Command Prompt
    - This involved starting Setup, confirming Country and Keyboard Layout, then
      pressing Shift + F10 to bring up a Command Prompt screen. From there, you
      typed 'oobe\bypassnro' and rebooted.
      * Patched: Windows 11 25H2 (poorly... see #5, #6)

 5. OOBE Bypass NRO flag via Command Prompt - variant 1
    - As above, but you needed to add a registry key instead and run a command to
      reboot:
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE /v BypassNRO /t REG_DWORD /d 1 /f
      shutdown /r /t 0
      * Patched: None

 6. OOBE Bypass NRO flag via Command Prompt - variant 2
    - This involves creating and running a batch script version of the entry
      from #5:
      @echo off
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE /v BypassNRO /t REG_DWORD /d 1 /f
      shutdown /r /t 0
      * Patched: None

 7. Unused Local Account Setup Modal via Command Line Oversight
    - This involved starting Setup, confirming Country and Keyboard Layout,
      then pressing Shift + F10 to bring up a Command Prompt screen. From
      there, you typed 'start ms-cxh:localonly' and rebooted.
      * Patched: Windows 11 25H2 (supposedly)

 8.  Unused Local Account Setup Modal via Developer Mode Oversight
    - This involved going through the initial Windows install step of copying
      files to the system drive. From there, you are prompted to set up
      Windows, which involved signing with a Microsoft Account. However,
      pressing
      Ctrl + Shift + J and then typing
     'WinJS.Application.restart("ms-cxh://localonly")'
      prompted an unused Local Account Setup modal, from where
      you can create a Local Account and continue setting up Windows 11.
      * Patched: Apparently Never

 9. Setting up Windows with a Microsoft Account, but Creating a Local Account
    Afterwards Loophole
    - Set up Windows 11 as usual, but create a second account through Settings
      * Patched: Windows 11 23H2(?)

10. OOBE Hide Online Account Screens Loophole
    - Same as # 4, but use
      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE /v HideOnlineAccountScreens /t REG_DWORD /d 1
      and reboot.
      * Patched: No

11. Create Local Account during Initial Setup Loophole
    - Same as #4, but do the following instead:
      net user “username” * /add
      net localgroup administrators "username" /add
      cd oobe
      msoobe && shutdown -r
      * Patched: Unknown (probably never)

12. Create Local Account during Initial Setup Loophole - Verbose
    - Same as #4, but do the following instead:
      net user “username” * /add
      net localgroup administrators “username” /add
      net user “username” /active:yes
      net user “username” /expires:never
      net user “Administrator” /active:no
      net user “defaultuser0” /delete
      net user
      Then go into regEdit HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE
      Delete DefaultAccountSAMName, Delete DefaultAccountSID, Delete DefaultAccountAction
      Edit LaunchUserOOBE and rename SkipMachineOOBE
      Make sure value is 1
      shutdown /r /t 0
      * Patched: No

13. Microsoft Account Sign-In 'Learn more' Link Loophole
    - This involved atopping at the 'Let's add your Microsoft account' step and
      clicking the 'Learn more' link in the paragraph under the Sign-in options
      link. Seriously. [Amusingly, that particular link did also mention
      creating a local account.] From there, you're sent to the Local Account
      page without doing a thing. Unsurprisingly, this is clearly a bug (and an
      amusing one at that), so I am not surprised that Microsoft had even
      patched it at all.
      * Patched: Windows 11 26H2
      Reference: https://www.windowslatest.com/2026/10/13/one-click-let-you-escape-microsofts-forced-sign-in-on-windows-11-of-course-microsoft-killed-it/