A new way to create a local user account - better than oobe\bypassnro

garlin · Apr 1, 2025

These are options from the Unattended file. Might as well just copy a template file to your USB.

Oh wait, Rufus can do that...

Code:

        <settings pass="oobeSystem">
me="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
                        <OOBE>
                                <HideEULAPage>true</HideEULAPage>
                                <HideLocalAccountScreen>true</HideLocalAccountScreen>
                                <HideOnlineAccountScreens>true</HideOnlineAccountScreens>
                                <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
                                <NetworkLocation>Work</NetworkLocation>
                                <ProtectYourPC>3</ProtectYourPC>
                        </OOBE>
                        <UserAccounts>
                                <LocalAccounts>
                                        <LocalAccount wcm:action="add">
                                                <Group>Administrators</Group>
                                                <Name>GARLIN</Name>
                                                <Password>
                                                        <PlainText>true</PlainText>
                                                        <Value></Value>
                                                </Password>
                                        </LocalAccount>
                                </LocalAccounts>
                        </UserAccounts>
                </component>
        </settings

cereberus · Apr 1, 2025

Actually, I just realised the method in this thread (start ms-cxh:localonly) is essentially the same method as in

Creating Local account in Windows 11 v24H2 build 26100.1742 by Chris Waite

Hello everyone, A new way to create local account in Windows 11 v24H2 is in the video. Please visit the link. {Courtesy :-The video on youtube by Chris Waite} The link is Thanking Chris Waite, 1. Run Windows 11 setup by bootable media. After installation process is completed, the pc restarts...

www.elevenforum.com

The command used there is a bit more complicated and is case sensitive:-

WinJS.Application.restart("ms-cxh://LOCALONLY")

I always found above to be a bit cumbersome, so I pasted it in a text file to avoid case sensitive typing errors.

start ms-cxh:localonly is much easier to type apart from minor detail, my brain always wants me to type xch rather than cxh LOL.

Again, I have pasted it into a text file to cut and paste easily into command prompt.

Note: when the local account screen pops up, I just click on password box and repeat password box without entering any text (i.e. no password).
This also saves a bit of initial setup time as you do not have to enter the slightly tedious three security answers. Of course, you can add password once setup.

garlin · Apr 3, 2025

hexacorn (a noted Windows security researcher) listed the Cloud Experience Host (ms-cxh) handlers three years ago. But no one noticed.
ms-cxh and ms-cxh-full handlers | Hexacorn

The W11 (not W10) version of ms-cxh://localonly is ms-cxh://setaddlocalonly

glasskuter · Apr 3, 2025

So @garlin, are you saying that at command prompt during install we should be entering
start ms-cxh://setaddlocalonly instead of start ms-cxh:localonly
OR are you saying we just enter ms-cxh://setaddlocalonly
with or without the "start" in front of it"????

You know how all this Greek scripting and command line stuff you, @pseymour and @hsehestedt spout out confuses this old woman. I do good to speak English.

garlin · Apr 3, 2025

Windows has a hidden list of resource handlers, basically shortcuts to access a built-in feature.

Create Shortcuts to Open Pages in Settings in Windows 11
List of URI Commands to Open Microsoft Store Apps in Windows 11

If you're in CMD, "start [handler]" asks Explorer to find the resource handler and launch it for us. When you type a Run Command (WIN + R), that's Explorer opening the same command. CMD always requires the start in front, but Explorer doesn't require it.

start ms-screensketch
start http://elevenforums.com

OOBE registers a set of cxh ("Connected Experience Handlers"), which are shortcuts to different OOBE screens. Why do they exist? Most retail users only see a small part of the entire OOBE experience, the other two-thirds is written for corporate clients running Autopilot to set up Windows PC's. IT admins may need to restart part of a failed Autopilot sequence.

ms-cxh://localonly is the W10 script, it has the W10 dark theme
ms-cxh://setaddlocalonly is the W11 script, it has the W11 light theme

Basically the same function, but updated for W11.

Also, all ms-cxh handlers are live on your Windows system. If you wanted to create a new user, without using the Settings app, run start ms-cxh://localonly. The only problem is it's designed to run from OOBE, and doesn't know how to exit when finished. You have to kill the window yourself.

cereberus · Apr 3, 2025

hsehestedt said:
I always do it on the first OOBE screen. At least for oobe\bypassnro, those screens will be presented again anyway after the reboot so I see no point in going through those screens more than once, but with start ms-cxh:localonly this is not the case. It skips all the screens after you enter the command (which I like!).

Mine still went through some privacy screens

garlin said:
Windows has a hidden list of resource handlers, basically shortcuts to access a built-in feature.

Create Shortcuts to Open Pages in Settings in Windows 11
List of URI Commands to Open Microsoft Store Apps in Windows 11

If you're in CMD, "start [handler]" asks Explorer to find the resource handler and launch it for us. When you type a Run Command (WIN + R), that's Explorer opening the same command. CMD always requires the start in front, but Explorer doesn't require it.

start ms-screensketch
start http://elevenforums.com

OOBE registers a set of cxh ("Connected Experience Handlers"), which are shortcuts to different OOBE screens. Why do they exist? Most retail users only see a small part of the entire OOBE experience, the other two-thirds is written for corporate clients running Autopilot to set up Windows PC's. IT admins may need to restart part of a failed Autopilot sequence.

ms-cxh://localonly is the W10 script, it has the W10 dark theme
ms-cxh://setaddlocalonly is the W11 script, it has the W11 light theme

Basically the same function, but updated for W11.

Also, all ms-cxh handlers are live on your Windows system. If you wanted to create a new user, without using the Settings app, run start ms-cxh://localonly. The only problem is it's designed to run from OOBE, and doesn't know how to exit when finished. You have to kill the window yourself.

Not sure I can see point of using w11 version as more to remember, and whether to us pesky forward or back slashes to remember.

Personally, I don't give a rat's posterior about like or dark theme at this point of oobe.

Persona78 · Apr 3, 2025

Hi!
I rebuild my windows ISO with this lines in registry on boot.wim and install.wim and it will show " I don't have internet connection" option and like that i can create a local account.

HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE BypassNRO dword 1
HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\UserSwitch Enabled dword 1

It worked for me...

hsehestedt · Apr 3, 2025

cereberus said:
Not sure I can see point of using w11 version as more to remember, and whether to us pesky forward or back slashes to remember.

The backslash thing is easy to remember. For paths on disk, registry, etc. it is always a backslash. For any parameters it is always forward slash.

I've also seen people confused by which is which. A backslash has the top of slash facing backwards while a forward slash has the top facing forward. Easy

hsehestedt · Apr 3, 2025

Persona78 said:
I rebuild my windows ISO with this lines in registry on boot.wim and install.wim and it will show " I don't have internet connection" option and like that i can create a local account.

That is one way to do it, but it's my personal favorite way to go about it. the problem with that method is that anytime you download a new ISO image, for example, a newer build, you have modify the ISO again. Also, what if you want to keep an original unmodified ISO? Now you have to keep 2 separate ISO images. Yuck!

Of course that may be fine for some people, but my preference is to use a simple answer file to create the local account. This way I need to make zero changes to the original ISO image which saves a lot of time and effort. Also, I can recycle the same answer file for any and all Windows ISO images I may download in the future so it takes zero effort for those new ISO images.

Again, that is merely my personal preference. Just noting it as a possible alternative.

Persona78 · Apr 4, 2025

hsehestedt said:
That is one way to do it, but it's my personal favorite way to go about it. the problem with that method is that anytime you download a new ISO image, for example, a newer build, you have modify the ISO again. Also, what if you want to keep an original unmodified ISO? Now you have to keep 2 separate ISO images. Yuck!

Of course that may be fine for some people, but my preference is to use a simple answer file to create the local account. This way I need to make zero changes to the original ISO image which saves a lot of time and effort. Also, I can recycle the same answer file for any and all Windows ISO images I may download in the future so it takes zero effort for those new ISO images.

Again, that is merely my personal preference. Just noting it as a possible alternative.

Yes you are right. But you only need to do in the new release, then Windows will keep updating normally.
I created a batch that automatically do that for me, mount iso, apply my changes, unmount, done.
I only do to new releases like from 23H2 to 24H2 as example.

My ISO i all modified by me, debloated, tweaked, add my apps, etc. But like i said i only do on new releases then is stored if i need a fresh install.

hsehestedt · Apr 4, 2025

Like I said, that may be absolutely fine for some people. Was simply trying to provide another idea.

BTW, if you do a lot of this sort of thing, you may want to check out my WIM-Tools project on GitHub (see my sig). Pretty much anything I can think of related to Windows Image Management is in that util. Just a few examples:

Inject drivers into Windows image(s)
Inject boot critical drivers into boot.wim and winre.wim
Inject Windows updates into your Windows image(s)
Modify Win image to bypass Win 11 requirements
Get Win image info
Modify Win image metadata
Create multi boot disk that will allow you to select from an unlimited number of Windows or WinPE / WinRE based ISO images and boot that image.
Much more!

Persona78 · Apr 4, 2025

hsehestedt said:
Like I said, that may be absolutely fine for some people. Was simply trying to provide another idea.

BTW, if you do a lot of this sort of thing, you may want to check out my WIM-Tools project on GitHub (see my sig). Pretty much anything I can think of related to Windows Image Management is in that util. Just a few examples:

Inject drivers into Windows image(s)
Inject boot critical drivers into boot.wim and winre.wim
Inject Windows updates into your Windows image(s)
Modify Win image to bypass Win 11 requirements
Get Win image info
Modify Win image metadata
Create multi boot disk that will allow you to select from an unlimited number of Windows or WinPE / WinRE based ISO images and boot that image.
Much more!

View attachment 130321

Thanks.

cereberus · Apr 4, 2025

hsehestedt said:
The backslash thing is easy to remember. For paths on disk, registry, etc. it is always a backslash. For any parameters it is always forward slash.

I've also seen people confused by which is which. A backslash has the top of slash facing backwards while a forward slash has the top facing forward. Easy

At my age, I cannot remember why I am in the kitchen LOL.

Persona78 · Apr 4, 2025

I find this video, not tested...

Maybe helps!

fg2001gf11F · Aug 16, 2025

Persona78 said:
Hi!
I rebuild my windows ISO with this lines in registry on boot.wim and install.wim and it will show " I don't have internet connection" option and like that i can create a local account.

HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE BypassNRO dword 1
HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\UserSwitch Enabled dword 1

It worked for me...

Yes, still needs bypassnro when there is no internet connection.

MisterEd · Aug 16, 2025

fg2001gf11F said:
Yes, still needs bypassnro when there is no internet connection.

A couple months ago I installed Windows 11 24H2 in a virtual machine. Networking was disabled on it. I was surprised that the following no longer worked.

Shift-F10
oobe\bypassnro

Instead I had to use this:

Shift-F10
start ms-cxh:localonly

I was then able to create a local account. After it was done I enabled networking.

fg2001gf11F · Aug 17, 2025

MisterEd said:
A couple months ago I installed Windows 11 24H2 in a virtual machine. Networking was disabled on it. I was surprised that the following no longer worked.

Instead I had to use this:

I was then able to create a local account. After it was done I enabled networking.

I tried that on a real machine without internet connection, and it just hung with a black screen after I created the local account. (Canary build 27924).

Edit:
Still unclear on the difference between the 2 commands.
start ms-cxh:localonly
start ms-cxh:setaddlocalonly
The 1st one works also without internet, while the second one work with internet but hangs with a black screen without internet after creating the local account.

Barbloki · Aug 19, 2025

cereberus said:
Super.

thank you for this information. I'm setting up a new laptop tomorrow and will try it. I don't want it to have a Microsoft account until I'm ready. I also want to remove all the Onedrive crap first.

jimbo45 · Aug 19, 2025

C'mon guys
Unless using Home edition of W11 what's wrong with the bog standard - no reg keys, oob commands etc way of doing it -

Just choose school or workplace for computer at the appropriate prompt and then for login option choose domain join.

I've mentioned this "Ad Nauseam" but still we get endless posts on this stuff requiring all sorts of complex ways to get "A local account".

Unless 99% of people here are using W11 HOME (which I really doubt) then what exactly is wrong with my method !!!.

Cheers
jimbo

pseymour · Aug 19, 2025

Not sure why you set the limit at 99%. Most consumer devices ship with the Home SKU, and that's what most people use at home. That's kind of why they call it the Home edition.

A new way to create a local user account - better than oobe\bypassnro

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

aka Mama Glass

My Computers

Well-known member

My Computer

Well-known member

My Computer

Member

Attachments

My Computer

Well-known member

My Computers

Well-known member

My Computers

Member

My Computer

Well-known member

My Computers

Member

My Computer

Well-known member

My Computer

Member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Member

My Computers

Well-known member

My Computer

putting the mental back in experimental

My Computer