Technical Tip: 'Users must enter a user name and password to use this computer' option not visible to enable VPN Before Logon for the user

[fatihseyligli]

Description	This article describes how to resolve the issue where the option 'Users must enter a password to use this computer' is not visible when running 'netplwiz' on Windows users.
Scope	FortiClient Windows.
Solution	FortiClient's 'VPN Before Logon' feature allows users to establish a VPN connection to the corporate network before logging into Windows. This is particularly useful in scenarios where the user's credentials are validated through a domain controller or when access to network resources is required during the login process. How it works: Before the user logs into Windows, the FortiClient endpoint prompts for VPN credentials. This allows the system to establish a secure connection to the corporate network. Once the VPN connection is established, the user's login credentials are authenticated against the domain controller over the VPN, ensuring that domain policies are applied. The VPN connection remains active throughout the logon process, allowing uninterrupted access to network resources. This is critical for users who need access to network drives, internal applications, or other resources that are only available once connected to the corporate network. How to activate VPN before Windows logon: In FortiClient, create a VPN tunnel of interest or receive the VPN tunnel from FortiClient EMS. On the Windows system, start an elevated command line prompt. Enter 'control userpasswords2' and press Enter. Alternatively, it is possible to type enter 'netplwiz'. Check the checkbox for 'Users must enter a user name and password to use this computer.' Select OK to save the setting.   In some cases, specifically on Windows 11 machines, the option 'Users must enter a user name and password to use this computer' might not be visible in the User Accounts interface. To resolve this issue, follow the steps: Open the Registry Editor (regedit). Navigate to 'Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device'. Change the value for DevicePasswordLessBuildVersion to 0. Restart the computer. After making this change, the option will be visible the next time the User Accounts window is opened. After completing this process, it is possible to see the FortiClient VPN icon in the Windows login phase below: Resources about VPN before logon and VPN pre-logon: Activating VPN before Windows logon FortiClient SSL-VPN Pre-Logon Overview VIDEO FortiClient SSL-VPN Pre-Logon: Part 1 VIDEO FortiClient SSL-VPN Pre-Logon: Part 2 VIDEO FortiClient IPsec VPN Pre-Logon Overview VIDEO FortiClient IPsec VPN Pre-Logon Configuration and Demo VIDEO Troubleshooting the pre-logon SSL VPN connection Per-machine pre-logon VPN connection without user interaction Configuring autoconnect with username and password authentication  Configuring autoconnect with certificate authentication