Created new Windows account, Steam was already signed in

[epmode]

I just installed Windows 11 and signed into Steam. Everything worked fine with the new login experience.

The strange thing is when I created a second Windows account and signed into it. For some reason, the credentials of my Steam account are stored even across different Windows accounts.

I definitely want Steam to automatically log me in while I'm in my own Windows account, but I don't want it to happen when someone else is logged into the computer!

Is this an unintended side effect of the new login method?

I tried signing out of Steam and using the -noreactlogin switch when logging back in, but it doesn't matter. Once I log into another Windows account and attempt to launch the Steam executable, it remembers the credentials I entered under my own Windows account.

[RiO]

Originally posted by epmode:

Is this an unintended side effect of the new login method?

No. This is an unintended side effect of Valve's development team consisting of Muppets.

They wrote Steam with complete and utter disregard for the folder permission model and multi-user account segregation in Windows. Instead, Steam is written like old applications from the early '90s: dump everything into the installation folder and manage it there.

Hence all Windows user accounts have access to the same pool of Steam users. And any Windows user is able to auto-login to Steam using the remembered auto-login credentials of any Steam account last accessed by any Windows user on the system.

Also; things get really fun when multiple Windows users simultaneously try to run the Steam client. (Please don't try it. Bad things happen.)

-------------------------

Of course you may wonder how they pull that off when normal user accounts and token-split administrators that haven't elevated with UAC yet, generally shouldn't have write permissions granted to them for application install folders. Certainly not for anything below the default Program Files location.

Well... Valve found a way around that. Steam installs a Windows Service component called the Steam Service, which runs under the SYSTEM user - i.e. the end-all-be-all can-do-anything 'root' account. When the Steam client starts, it tells Windows to start that service. When that service starts, it uses its root powers to give write permission to all users for the entire Steam folder, as well as some areas of the Windows registry.

And yes; that is as sensitive to security problems and exploitation as you think it would be.

In fact: it actually did contain a bug that created a trivial permission elevation vulnerability allowing malicious actors to exploit Steam to access any folder or registry segment on the system with full access; and by extension to set up situations where they could get the SYSTEM user to run arbitrary code of their choosing. First discovered around 2014. Finally patched by Valve in 2018~2019, half a decade later, because the last person to report it was fed up with their inaction and went public with a proof of concept.

[epmode]

This is kind of a problem then.

[SjadoN]

Just had the same thing. I was very suprised. I found a discussion from februari that said you had to "opt-out of steam beta".

Well, I wasn't in the steam beta, but I opted in and this sort-of fixed it for me.

When I now switch windows users, and start steam, it will kill steam for the other user, but it does login in with the right user for that account.

[i like to eat apples]

This is still an issue.

[Supafly]

Originally posted by i like to eat apples:

This is still an issue.

If you want Steam to be separate per Windows accounts install Steam to different location/drives for each Windows accounts.

For Drives
Windows 1 installs Steam to C:\
Windows 2 installs Steam to D:\

For locations Install Steam to the users Windows Account
Windows 1 installs Steam to C:\Users\WindowsAccount_1\
Windows 2 installs Steam to C:\Users\WindowsAccount_2\

Be sure that the Steam Desktop shortcut is links to the correct WindowsUser/Steam install