Section 1: Login and User Accounts

The Big Picture: The Front Door

Think of your PC as a building. Many people might want to come in: you, a family member, a guest, an office colleague. A guard at the door has to answer one question for each person: "Who are you, and can you prove it?"

In Windows, that guard is the logon system. You type a password (or touch a fingerprint reader) and Windows decides whether to open the door. If it does, it also remembers who you are for the whole time you are signed in, so it can later decide what you may open, read or change.

Key words in this chapter:

1.1 Local Accounts vs Microsoft Accounts vs Domain Accounts

What it is: An account is how Windows knows a person. There are three main kinds. The difference is where the account lives and who checks the password.

LOCAL ACCOUNT          MICROSOFT ACCOUNT        DOMAIN ACCOUNT
lives on THIS PC       lives in Microsoft's     lives on a company server
                       online service           (the domain controller)
                       (plus a local copy)

Checked by: this PC    Checked by: Microsoft    Checked by: the domain
                       online (or a cached      controller
                       copy when offline)

1. Local account. Created on one PC and stored only on that PC. It works only on that PC. If you have two PCs with the same user name, they are two unrelated accounts.

2. Microsoft account. An email address (like name@outlook.com) that you also use for Microsoft 365, the Store and OneDrive. When you sign in to Windows 11 Home with one, Windows still creates a local profile on the PC, but your sign-in is tied to the online account. This lets settings and files follow you between devices. Windows 11 Home normally asks you to sign in this way during setup.

3. Domain account. Used in companies and schools. A domain is a group of computers managed together. One special server, the domain controller (DC), runs a directory service called Active Directory (a big, central address book of users, computers and groups). Your account lives there, so the same user name and password work on every PC in the company. A PC joins a domain with Windows Pro, Enterprise or Education (not Home). (Many companies now use Microsoft Entra ID, formerly Azure AD, for a similar online job. The idea is the same: a central place checks you.)

Built-in accounts. Windows also makes a few accounts by itself:

• Administrator (the built-in one) is the all-powerful account. It is disabled by default on a normal Windows 10/11 PC. (Your own account may be an administrator, but it is a different account.)
• Guest is a limited account for visitors. It is also disabled by default on current Windows versions.
• DefaultAccount and WDAGUtilityAccount exist for system use. You can ignore them.

Hedge: exact built-in accounts can differ a little between Windows versions and editions.

Standard vs administrator. Every normal account belongs to groups. Two matter most:

Good habit: Use a standard account for daily work and keep an administrator account for when it is needed. If malware runs as a standard user, it can do far less damage.

Windows tip: Press Win + R, type netplwiz, and press Enter to see the accounts on your PC. Or, in PowerShell, type Get-LocalUser to list them with their Enabled status (you will use this in the lab).

1.2 Password Storage (Never Plaintext — Hashed)

What it is: Windows never stores your password as readable text. Instead it stores a hash.

What is a hash? A hash is a one-way scramble. You put data in, a mathematical recipe (a hash function) mixes it up, and a fixed-size "fingerprint" comes out. Two key rules:

1. The same input always gives the same fingerprint.
2. You cannot run it backwards to get the input from the fingerprint.

Analogy: think of a meat grinder. Beef goes in, mince comes out. The same beef always gives the same mince, but you cannot turn the mince back into the steak.

 You type:  "MyPassw0rd"
                │
                ▼
        ┌───────────────┐
        │ hash function │   (one-way scramble)
        └───────┬───────┘
                ▼
   stored:  9f2c...a71e      (a fixed-size fingerprint)

How a login check works. When you sign in, Windows hashes what you just typed and compares it with the stored hash. If they match, the password was right. At no point does Windows need to look up the real password, because it does not have it.

 Typed password ──hash──► fingerprint A ──┐
                                          ├── equal? ──► YES: let in
 Stored in database ───► fingerprint B ───┘             NO: refuse

Where hashes live.

Why hash and not encrypt? Encrypted data can be decrypted by whoever has the key. A hash has no "undo", so even someone who reads the database does not directly get your password.

Important safety notes (plain words, no detail needed):

• Windows adds protection around the stored values. Details of the exact algorithms change between versions, so we do not list them here.
• A long, unique password is much harder to guess than a short common one. Length matters more than odd symbols.
• Better than any password: Windows Hello (fingerprint, face or PIN), which Section 6 explains.

Why this matters to you: Because only hashes are stored, Microsoft support or your IT team cannot read your old password. They can only reset it.

Summary