Windows 11 OOBE: Password Only Sign In Restored Every PC Backup and Saved Credentials

By Mor Golan · November 7, 2026

Summary

I found that the Windows 11 setup wizard, the Out of Box Experience (OOBE) that runs on first boot, after a factory reset or when restoring a PC, offered a password option in place of the Authenticator number matching prompt my account normally shows.
With only the password, setup listed every PC backup stored in the account and restored one of them, including Folders, Apps, Settings and Credentials, without asking for any further verification.
The account owner received no email, push notification or security alert at any point.

My account did not have two step verification turned on.
It used the Authenticator app as a passwordless sign in method, and for that setup Microsoft treats the password as a valid alternative.
That is why MSRC classified the report as by design.
The point of this writeup is what that single password unlocks during setup, and that the Authenticator prompt gives the impression of a protection it does not provide.

I tested this on my own Microsoft account and my own devices.

What happens

1. Boot any Windows 11 device into OOBE, either a new installation or a factory reset.
   It does not have to be the victim’s hardware.
2. On “Unlock your Microsoft experience”, click Sign in and enter the victim’s Microsoft account email.
3. The “Check your Authenticator app” screen appears with a number to match.
   Do not approve anything in the app.
4. Click Other ways to sign in, then choose Use my password.
5. Enter the password and click Sign in.
   The sign in succeeds without any Authenticator approval.
6. Continue through setup.
   OOBE asks to create a new Windows Hello PIN on the device, which gives the attacker persistent local sign in.
7. On “Select a device to restore from”, every PC backup in the account is listed with its device name and last backup date.
   In my test four backups from four of my devices were listed.
8. Select a backup and click Continue.
   Windows restores Folders, Apps, Settings and Credentials from that backup with no additional verification.

It needs no tools and takes three clicks from the Authenticator screen.

Impact

The Credentials category restores the contents of Windows Credential Manager: saved website passwords, Remote Desktop credentials, network share credentials and similar secrets stored on the backed up PC.
Together with the restored folders and app settings, a single known password turns into a copy of the victim’s PC on the attacker’s own machine.

The device the attacker sets up also gets a new Windows Hello PIN, so the attacker keeps local access to it without the password.

Nothing in the flow told the account owner that it happened.
There was no new sign in alert by email or push, even though the sign in came from a new device and did not use the Authenticator prompt the account normally shows.

Why this matters

Several design choices combine here:

• The prompt suggests protection that is not there. A user who approves an Authenticator number at every sign in reasonably believes the account needs that approval.
  During setup, the password alone was enough.
• No risk checks on the password path. There was no step up for a new device, an unknown IP address or an unusual location.
• No notification. The owner was not alerted when a new device signed in with only the password.
• Privileged access right after sign in. OOBE showed the full backup catalogue immediately, with no second confirmation.
• Credentials included in the restore. Saved credentials were restored without any extra confirmation.

Microsoft’s response

I reported the issue to MSRC on May 10, 2026 with the full steps and a video of the sign in and restore.
Microsoft classified it as by design and did not assign a CVE.

When I went through setup again later, it required the Authenticator approval.
I have since turned on two step verification, so I cannot say whether that or a change in setup closed the path for my account.

How to protect yourself

• Turn on two step verification for your Microsoft account at account.microsoft.com under Security, Advanced security options.
  An Authenticator prompt on its own does not mean your password is not enough.
• Use a long, unique password for your Microsoft account.
  This chain starts with knowing the password.
• Where you can, make a passkey or a hardware security key your sign in method.
• Review recent sign in activity at account.microsoft.com under Security.
• Check what Windows Backup stores under Settings, Accounts, Windows Backup, and consider whether you want credentials included.

Timeline

• 2026-05-10: Reported to MSRC.
• MSRC classified the report as by design.
  No CVE was assigned.
• 2026-11-07: Published.

All research · All CVEs