How to Enable a Privacy and Security Notice Prior to Windows Logon

In enterprise environments, displaying a mandatory security warning or legal consent banner prior to user logon is standard practice for ISO 27001, NIST SP 800-53, SOC 2, and HIPAA compliance. Windows includes a native feature called Interactive Logon Message that forces a pop-up dialog box to appear before the user can enter their credentials, requiring explicit acknowledgment.

Below is a complete, step-by-step guide explaining three methods to configure this feature: via Group Policy (GPO), Local Security Policy, Windows Registry / PowerShell, and Microsoft Intune.

What the End User Sees

When enabled, the Windows logon sequence changes as follows:

1. The user presses Ctrl + Alt + Delete, presses a key, or swipes up on the lock screen.
2. A pop-up modal dialog box appears on screen displaying your custom Title and Security/Privacy Notice Body Text.
3. The password/PIN prompt is completely blocked until the user clicks OK (or presses Enter) to acknowledge the terms.

Method 1: Using Group Policy (GPO) — Recommended for Enterprise Domains

If your systems are part of an Active Directory domain, deploying via Group Policy Management Console (gpmc.msc) provides centralized enforcement.

Step-by-Step Instructions:

1. Press Win + R, type gpmc.msc, and press Enter.
2. Right-click the targeted Organizational Unit (OU) or Domain, select Create a GPO in this domain, and Link it here…, and name it Interactive Logon Banner Policy.
3. Right-click the new GPO and click Edit.
4. Navigate to:
   Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Security Options
5. In the right pane, locate and configure these two settings:
   • Interactive logon: Message title for users attempting to log on
     • Double-click, enable, and type your header (e.g., WARNING: AUTHORIZED ACCESS ONLY).
   • Interactive logon: Message text for users attempting to log on
     • Double-click, enable, and paste your legal banner/privacy notice text.
6. Click Apply and OK.
7. Force a policy refresh on target PCs using gpupdate /force in PowerShell/CMD, or wait for the standard refresh cycle.

Method 2: Using Local Security Policy (secpol.msc) — Standalone PCs

For single workstations or non-domain-joined PCs running Windows 10/11 Pro, Enterprise, or Windows Server:

1. Press Win + R, type secpol.msc, and press Enter.
2. Expand Local Policies in the left navigation tree, then click Security Options.
3. Scroll down and open:
   • Interactive logon: Message title for users attempting to log on
   • Interactive logon: Message text for users attempting to log on
4. Enter the title and text in their respective fields.
5. Click Apply and OK.
6. Lock your PC (Win + L) or log off to test the prompt.

Method 3: Deploying via Microsoft Intune (Cloud-Managed)

For environments managed via Microsoft Intune / Endpoint Manager:

1. Log into the Microsoft Intune Admin Center.
2. Go to Devices > Configuration profiles > Create profile.
3. Select Windows 10 and later as Platform and Settings catalog as Profile type.
4. In the Settings picker, search for Local Policies Security Options.
5. Check both:
   • Interactive Logon Message Title For Users Attempting To Log On
   • Interactive Logon Message Text For Users Attempting To Log On
6. Fill in your notice title and text content.
7. Assign the profile to your target device groups and click Save.

Sample Legal / Privacy Notice Template

If you need policy text ready for corporate compliance, feel free to use or adapt this standard wording.

**NOTE: We strongly recommend legal review of this language prior to implementation**

WARNING: AUTHORIZED ACCESS ONLY

This system is restricted to authorized users only. By accessing this system, you acknowledge compliance with the Acceptable Use Policy and consent to continuous monitoring, logging, and auditing of all activity. Unauthorized access or use may result in disciplinary action, civil liability, or criminal prosecution. Disconnect immediately if you are not an authorized user. By clicking OK and logging into this system, you acknowledge and consent to these terms.

Applicability

System Warning Banners & Monitoring Consent

ISO/IEC 27001 & ISO/IEC 27002

• A.5.10 (Acceptable Use of Information and Other Associated Assets): Requires clear rules and policies regarding the permissible use of information systems, often acknowledged at log-in.
• A.8.18 (Use of Privileged Utility Programs): Mandates controlling and monitoring access to system utilities, usually enforced via warning banners and log retention.
• A.8.20 (Network Security): Recommends system banners to warn unauthorized users at entry points.

NIST SP 800-53 (Rev. 5)

• AC-8 (System Use Notification): Explicitly requires displaying an approved system use notification before granting access. The notice must state that the system is for authorized use only, activities are subject to monitoring/auditing, and there is no expectation of privacy.
• AU-2 / AU-6 (Audit Events & Audit Record Review): Requires systems to record user actions and routinely review logs for unauthorized activity.

NIST SP 800-171 (Rev. 3)

• 3.1.9 (System Use Notification): Mandates displaying system use notifications or banners containing privacy and security warnings before granting access to CUI systems.
• 3.3.1 (Audit Events): Requires creating and retaining audit records to track authorized and unauthorized system interactions.

NIST Cybersecurity Framework (CSF 2.0)

• PR.AA-01 (Identity & Access Management): Requires access to physical and logical assets to be limited to authorized users and managed in accordance with operational risk.
• DE.CM-01 (Continuous Monitoring): Mandates monitoring the network and systems to detect potential cybersecurity events and unauthorized access attempts.

HIPAA Security Rule (45 CFR § 164.312)

• § 164.312(a)(1) (Access Controls): Mandates technical policies to allow access only to authorized persons or software programs.
• § 164.312(b) (Audit Controls): Requires mechanisms to record and examine activity in systems containing or using Electronic Protected Health Information (ePHI).

PCI DSS (v4.0)

• Requirement 8.2.2: Mandates displaying an explicit warning banner or notification stating that system access is restricted to authorized users only, and that usage may be monitored.
• Requirement 10.2.1: System components must log all user access to cardholder data and administrative actions.

GDPR (General Data Protection Regulation)

• Article 5(1)(f) & Article 32 (Security of Processing): Requires appropriate technical measures to prevent unauthorized or unlawful processing. Notice banners establish a legal basis for auditing and protecting data processing environments.
• Recital 49: Recognizes system monitoring as a legitimate interest for ensuring network and information security.

SOC 2 (Trust Services Criteria)

• CC6.1 (Logical Access Controls): Requires logical access security software and infrastructure parameters to restrict access to authorized personnel.
• CC6.8 (Unauthorized / Malicious Code Protection): Mandates monitoring system inputs and access attempts to prevent or detect unauthorized modifications.