You *can* setup a user id without a password in Windows.

If that's where they're using it, odds are, they'll use the same password they're using everywhere else or they'll write it down. While you can ask for their Windows UI/PWD, if they're even asked for the login, the user probably knows that already.

Four question auth seems like overkill for an in-home, locally installed application.

What type of application is this that you need to go to such great lengths?

>As far as I know, they are only going to be using this application on their home business-stand alone laptop connected to their home network. Do I need to look at capturing their login to get into their laptop?