One of the recommended methods for bypassing Microsoft account login during the Windows 11 OOBE is to attempt to log in using a locked account (no @thankyou.com being the most commonly recommended account to use). This causes an error on the server side that would then allow Windows to be installed using a local account.
Though there are other methods to bypass the login, such as the OOBE\BYPASSNRO method, some may prefer or require to use the 'locked account' method over others due to simplicity, time constraints or otherwise wishing to keep an active connection during setup (eg. for preliminary updates). Using a random gibberish domain as opposed to a known, registered domain reportedly fails occasionally to trigger the server-side error allowing a local account to be used. I am already aware of these alternative methods, so I am not asking for them to be explained here.
In various discussions on this general topic, there have been security concerns raised about attempting to use a locked account tied to the owner of a domain such as ‘thankyou.com’ (which in this case happens to be Citibank).
As suggested in a comment in this question, could the domain owner be granted privileges remotely over an OS installed this way? Is there some facility in the backend of Microsoft’s servers that would allow for an attack vector like this?
