Issues with Windows logins being crossed

Question

Issues with Windows logins being crossed

J. Stephen 20

We have an issue where on a few computers where multiple users log in, their logins are somehow getting crossed up, and when they try to log back in later, it will not accept their password. They have to click "Other User" and then enter their credentials. After doing some digging and running some commands, I ended up getting this output:

User's image

Not sure why its doing that, but we have it happening on a few different computers at the moment, and havent found out why its just those because we have many computers in the plant with multiple logins. I rebooted and it cleared the sessions, and on one computer I went into Credentials Manager and wiped it clean just to make sure it wasnt any old cached credentials because we just changed companies recently so there were some things that changed to our email addresses tied to our AD accounts, and it is still happening. The common denominator in this scenario is user2. and whats weird is on another computer he's logged into, its showing his user logon name (******@company.com) instead of domain\user2 for some of the entries...and others it shows domain\user2 for LoggedOnUser AND LoggedOnSAMUser. Any idea how to fix this?

0 comments

1 answer

Your answer

Answer 1

Hello J. Stephen,

Thank you for posting your question on the Microsoft Windows Forum!

Based on your description, the UPN (******@company.com) appears to be associated with the SAM account of a different user (domain\user3). This makes me think the problem is less likely to be a password issue and more likely to be related to cached identity information, UPN changes, or hybrid identity synchronization.

What I'd Like to Confirm

Has user2 recently had any of the following changed?

User Principal Name (UPN)
Email address
AD logon name
Entra ID / Azure AD identity

If the UPN changed but some machines still hold older sign-in metadata, Windows can sometimes display or cache identities differently than the underlying AD account.

One Check That Will Help

On an affected machine, please run:

dsregcmd /status

I'm particularly interested in:

AzureAdJoined
DomainJoined
WorkplaceJoined

The reason I ask is that seeing a mix of:

domain\user

and

******@company.com

on the same machine often occurs when Active Directory and Microsoft Entra ID identities are both in play.

Another Place to Check

Please compare the following registry values on a working and affected machine:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI

Specifically:

LastLoggedOnUser
LastLoggedOnSAMUser

I'd be interested to see whether the mismatch between:

******@company.com

and

domain\user3

also appears there.

The screenshot suggests Windows is storing or resolving the identity of one user against the security principal of another, which would explain why selecting Other User and manually entering credentials works correctly.

Microsoft documentation that may help with device registration and hybrid identity troubleshooting:

Could you share the output of:

dsregcmd /status

from one affected machine?

That should help determine whether we're looking at an AD-only issue or a hybrid identity registration mismatch.

I hope this answer has brought you useful information. If so, please click on "Accept Answer"and consider upvoting it. Doing so helps other community members identify useful solutions to similar issues.Thanks,

Maurice

Chance Maurice Niyonzima 500 Reputation points Independent Advisor

2026-10-15T11:06:11.6733333+00:00

Hello J. Stephen,

I wanted to follow up and see whether you had a chance to review the identity mapping observations from the previous discussion.

The screenshot you shared showing:

LoggedOnUser = ******@company.com LoggedOnSAMUser = domain\user3

is still the most significant finding, as it suggests Windows may be associating the UPN of one user with the SAM account of another user on the affected machines.

Were you able to determine whether user2 or user3 recently had:

A UPN change

An email address change

An account migration

A domain or company-name transition

Also, did you have a chance to check:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI

for:

LastLoggedOnUser LastLoggedOnSAMUser

and compare those values on an affected machine versus a healthy one?

Since users can successfully sign in after selecting Other User, the evidence still points more toward a cached identity/sign-in context issue than an actual password or Active Directory authentication problem.

If you have the output of:

dsregcmd /status

from one of the affected computers, please share it as well. That will help confirm whether there is any Microsoft Entra ID or workplace registration component involved.

Any updates you can provide would be greatly appreciated and should help narrow down why only certain shared computers are exhibiting this behavior.

I hope this answer has brought you useful information. If so, please click on Accept Answer and consider upvoting it. Doing so helps other community members identify useful solutions to similar issues.