Using two passwords for Windows accounts

Question

I was wondering about credential management when the user has a password and a tech support personell must ask for it.

Is there a way to use two passwords for the same account in windows? For example an user password and a supervisor password, as often is seen in various BIOSes configuration utilities.

From what I've researched I found that windows has support for custom authorization mechanisms since windows xp with the "GINA" (graphical identification and authentication) modules and I believe windows 10 supports something like that too.

But I wouldn't want to make this a programming question, so I would like to do this without extensive modifications to the operating system, maybe by using some software utility to implement this.

In this tech support scenario where I need to be able to login as the user, and was thinking about how to handle logging in the user session without having to know the password (e.g. a way to set a 'service' password for all computers in the office).

The closest thing I can imagine it is as the windows equivalent of doing su - user in linux from root. But afaik no way to "hijack" an interactive session.

I will probably end up using some RAT like teamviewer or better if I can find one that runs as administrator but lets me see and control a logged in user's session.

Answer 1

Windows Credential Manager only supports a 1-1 relationship of passwords to logins. This is by design. You'd be better off creating 2 profiles.

Answer 2

Windows Hello allows multiple forms of login for the same user account.

You need to set a password on the account before this can be enabled, but after that, you can set a pincode, facial recognition, fingerprint unlock and even an image unlock (click or draw 3 times on an image)

A pincode must contain numbers, but can also contain upper case letters, lower case letters and symbols, and they cannot contain sequences of the same number, nor multiples of the same number. Eg 1122 is not allowed, nor 13-13.

I couldn't find the minimum OS requirements for Windows Hello, so I'm not entirely sure if this function exists in Windows 10 Home. I know for sure it exists in Windows 10 Pro and up.

To setup Windows Hello login, go to Settings, Accounts, Sign-in options, scroll down to Pin and select Add.

Do note: once this is setup, the default is now to login with the pin, but you can still press more sign-in options and switch to password. The same applies for the other sign-in options. You can add several, but only one is the default and the rest is only accessible once you switch to it.

Also note, this will still give the user the same privileges, its just that it allows you to give someone access to your account without telling them the main password. If you really need to differentiate between local user and administrator, Create a second user with admin privileges, and demote this user to regular user. That way, you still share the same account with programs etc, but to make changes to the computer, you need to login with a second user.

You can of course also create a user with admin privileges and use that mainly for yourself.