How to Solve the "Cannot Log In" Issue When Adding a Domain User in a Remote Work Environment
Introduction
Now that remote work has become the norm, there is a problem that IT administrators encounter frequently, yet there is surprisingly little information about it online.
"I added a new user to a PC joined to an Active Directory domain, but they cannot log in."
I was able to add the user with administrator privileges via VPN. However, when that user tries to log in for the first time... the authentication fails. Why?
In this article, I will explain how to solve this remotely without going on-site.
Why can't they log in?
The cause is simple.
When an Active Directory domain user logs on to a PC for the first time, the PC must communicate with the domain controller (DC) to perform authentication.
Normally, if you are on the corporate network, you can communicate with the DC, so there is no problem. However, in a remote work environment, the following dilemma occurs:
The VPN is not connected at the login screen.
Since the VPN is not connected, you cannot communicate with the DC.
Since you cannot communicate with the DC, domain authentication fails.
Since authentication fails, you cannot log in.
In other words, it is a chicken-and-egg problem where "you need a VPN to log in, but you need to log in to connect to the VPN."
By the way, for the second login onwards, you can log in even if you cannot communicate with the DC due to a mechanism called "cached logon." This is because Windows caches authentication information locally (by default, for the last 10 users).
The problem is only the first logon.
Solution: Local Account → VPN → Switch User
Prerequisites
A local administrator account must be set up on the target PC.
A VPN client (such as FortiClient) must be installed.
Procedure
Step 1: Log in with a local administrator account
First, log in to Windows using a local administrator account instead of a domain account.
Enter the following on the login screen:
Username: .\administrator or PC-name\administrator
Password: Local administrator password
💡 The .\ at the beginning is the notation for specifying a local account.
Step 2: VPN connection
Once logged in, establish a VPN connection as usual. This connects the PC to the corporate network, allowing it to communicate with the domain controller.
Step 3: Switch users
This is the key to this method.
Windows key + L to lock the PC.
Select "Other user" from the user list displayed in the bottom left of the lock screen.
Enter the username and password of the new domain user here to log on.
💡 If the PC is already joined to the domain, the username alone is usually sufficient. In many cases, you do not need to include the domain name like DOMAIN\username.
Step 4: Initial logon complete!
Since the PC can communicate with the DC via VPN, the initial domain authentication will succeed, and the logon will be completed.
At this point, the authentication information is cached locally.
From then on, you will be able to log in via cached logon even without a VPN connection.
How to perform the "Switch user" operation (supplementary note)
These are the specific steps to guide a user who is unfamiliar with this operation over the phone.
Method A: Windows Key + L (Easiest)
While holding down the Windows key on the keyboard, press L
The lock screen will be displayed.
Click "Other user" from the user list at the bottom left of the screen.
Enter the username and password, then press Enter.
Method B: Ctrl + Alt + Delete
Press Ctrl + Alt + Delete simultaneously.
Select "Switch user" from the menu.
Click "Other user" at the bottom left.
Enter the username and password, then press Enter.
Method C: Start Menu
Click the Start button.
Click the user icon on the left side.
Select another username.
Supplement: Notes on Cached Logon
Number of cached entries
By default, Windows caches the credentials of the 10 most recent users. If more than 10 users use the same PC, the oldest cache will be overwritten.
When changing passwords
If you change your password on the domain, you can only log on via cache using your old password until you next log on while able to communicate with the DC (e.g., while connected to VPN or in the office). After changing your password, you must connect to the VPN and log on again.
Applying Group Policy
Since the system does not communicate with the DC during cached logon, new Group Policy settings will not be applied. If you need to update policies, please log on while connected to the VPN and run gpupdate /force.
Another option: Pre-logon VPN
As a fundamental solution, there is also a setting to automatically connect to the VPN at the login screen.
FortiClient: "Enable VPN before logon" option
Windows Always On VPN: Device tunnel configuration
However, these require initial setup and must be configured on the target PC in advance. If you need to handle just one machine immediately, the method introduced in this article is easier.
Summary
Problem: Cannot perform initial domain user logon on a remote PC
Cause: Cannot communicate with DC because VPN is not connected at the login screen
Solution: Log in with a local account → Connect to VPN → Switch users
Time required: About 5 minutes
On-site work: Not required (can be guided via phone or chat)
This method is simple once you know it, but it is surprisingly not well-documented. With the spread of remote work, this situation is bound to occur more frequently.
I hope this helps save time and travel costs for all IT administrators.