The Windows break-glass account and what to do when nobody can sign in

The break-glass account lets you recover a computer when the second factor is impossible. Define it before deploying the agent.

How do I define the break-glass account?

1. Under «Manage» › «Computers» › «Offline sign-in and break-glass», choose «Break-glass account» › «Only offline, at the console».
2. In «Break-glass account SIDs (at most 2, one per line)», enter the SIDs (usually the LAPS-managed local administrator).
3. Choose «Save».

How does it work?

• Those accounts sign in with the password only, only offline and only at the console: never over remote desktop and never while the computer is online and healthy.
• The panel shows «Emergency account — use is recorded and audited» and «Use it only to recover this computer. IT support is notified.»
• Each use is reported as desktop.break_glass with a failure outcome, so it raises an alert.
• Change the account's password after each use; Windows LAPS does it for you.

Nobody can sign in

In this order:

1. Use the break-glass account, offline, at the console.
2. Or set Safe Mode to «Password only (audited)» by GPO and boot into Safe Mode. Use it only as a temporary recovery.
3. Or, from WinRE with the BitLocker recovery key, run msiexec /x for the product: uninstalling removes the provider first and Windows returns to its own options.

The panel says the computer's service is not responding

«The AuthGuard service on this computer is not responding.»: the agent service stopped. Restart it as an administrator (Restart-Service AuthGuardDesktop) or restart the computer; if it persists, use the steps above and contact support.