# US 11,030,298 B2 · Candidate user profiles for fast, isolated operating system use > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,030,298 B2 - Document ID: US11030298B2 - Status: Granted - Kind: B2 - Application number: 16/378,020 - Filed: 2019-04-08 - Published: 2020-10-08 - Granted: 2021-06-08 - Earliest claimed: 2019-04-08 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Nathan Jeffrey Ide; Ibrahim Mohammad Ismail; Robert Bradley Gilbert; Haitao Wang; Matthew Jonathan Joplin - Web page: https://patentgrep.com/patent/US11030298B2 ## CPC - G06F 21/45: Structures or tools for the administration of authentication - G06F 21/34: involving the use of external additional devices, e.g. dongles or smart cards - G06F 2221/2149: Restricted operating environment - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods and devices for using candidate accounts on a computer device may include creating on the computer device, a candidate account representing a blank user profile for use on the computer device. The methods and devices may include automatically logging in the candidate account and locking the computer device. The methods and devices may include creating a user specific isolated environment on the computer device for the candidate account. ## Claims ### Claim 1 A computer device, comprising: a memory to store data and instructions; at least one processor configured to communicate with the memory; and an operating system configured to communicate with the memory and the at least one processor, wherein the operating system is operable to: create a candidate account representing a blank user profile for use on the computer device; automatically login the candidate account and lock the computer device; and create a user specific isolated environment on the computer device for the candidate account. ### Claim 2 (depends on 1) The computer device of claim 1, wherein the candidate account further includes a candidate profile used to launch processes on the computer device to enforce the user specific isolated environment. ### Claim 3 (depends on 2) The computer device of claim 2, wherein the operating system is further operable to: receive user credentials to log into a user account on the computer device; access user profile information associated with the user account; and transform the candidate profile to a connected user profile for the computer device with a connected account. ### Claim 4 (depends on 3) The computer device of claim 3, wherein the connected account uses the processes for the user specific isolated environment already running on the computer device. ### Claim 5 (depends on 3) The computer device of claim 3, wherein the user profile information includes personalized settings for the user account. ### Claim 6 (depends on 3) The computer device of claim 3, wherein the operating system is further operable to access the user profile information from a remote server. ### Claim 7 (depends on 3) The computer device of claim 3, wherein the operating system is further operable to: create a new candidate account for the computer device in response to the connected account being created. ### Claim 8 (depends on 7) The computer device of claim 7, wherein the operating system is further operable to: log out the user account from the computer device; automatically login on the new candidate account; and lock the computer device. ### Claim 9 (depends on 1) The computer device of claim 1, wherein the operating system is further configured to create the candidate account in response to at least one of receiving policy information indicating when to create the candidate account, a boot event occurring on the computer device, the computer device powering on, or logging out of a user account. ### Claim 10 A method for using candidate accounts on a computer device, comprising: creating, at an operating system on the computer device, a candidate account representing a blank user profile for use on the computer device; automatically logging in the candidate account and locking the computer device; and creating a user specific isolated environment on the computer device for the candidate account. ### Claim 11 (depends on 10) The method of claim 10, wherein the candidate account further includes a candidate profile used to launch processes on the computer device to enforce the user specific isolated environment. ### Claim 12 (depends on 11) The method of claim 11, further comprising: receiving user credentials to log into a user account on the computer device; accessing user profile information associated with the user account; and transform the candidate profile to a connected user profile for the computer device with a connected account. ### Claim 13 (depends on 12) The method of claim 12, wherein the connected account uses the processes for the user specific isolated environment already running on the computer device. ### Claim 14 (depends on 12) The method of claim 12, wherein the user profile information includes personalized settings for the user account. ### Claim 15 (depends on 12) The method of claim 12, wherein the user profile information is accessed from a remote server. ### Claim 16 (depends on 12) The method of claim 12, further comprising: creating a new candidate account for the computer device in response to the connected account being created. ### Claim 17 (depends on 16) The method of claim 16, further comprising: logging out the user account from the computer device; automatically logging in the new candidate account; and locking the computer device. ### Claim 18 (depends on 10) The method of claim 10, creating the candidate account occurs in response to at least one of receiving policy information indicating when to create the candidate account, a boot event occurring on the computer device, the computer device powering on, or logging out of a user account. ### Claim 19 A non-transitory computer-readable medium storing instructions executable by a computer device, comprising: at least one instruction for causing the computer device to create a candidate account representing a blank user profile for use on the computer device; at least one instruction for causing the computer device to automatically login the candidate account and lock the computer device; and at least one instruction for causing the computer device to create a user specific isolated environment on the computer device for the candidate account. ### Claim 20 (depends on 19) The non-transitory computer-readable medium of claim 19, wherein the candidate account further includes a candidate profile used to launch processes on the computer device to enforce the user specific isolated environment.