Auto Logon

Check Description

This check determines whether the Auto Logon feature is enabled on the scanned computer, and if the logon password is encrypted in the registry or stored in plaintext. If Auto Logon is enabled and the logon password is stored as plaintext, the security report reflects this as a high-level vulnerability. If Auto Logon is enabled and the password is encrypted in the registry, the security report reports this as a potential vulnerability.

Note

If you get the message "Error Reading Registry," the Remote Registry service might not be enabled.

Auto Logon stores your logon name and password in the registry, allowing you to automatically log on to Microsoft® Windows® Server 2003, Windows XP, Windows 2000, or Windows NT® without typing your user name or password in the logon user interface. However, Auto Logon could also enable other users to access your files and use your name to commit malicious acts on the system. (For example, anyone with physical access to the computer can boot the operating system and automatically be logged on.) If you have Auto Logon enabled and you do not want to change it, make sure that you do not store any sensitive information on the computer.

You can store the password that you use for automatic logon as plaintext in the registry or you can encrypt it as a Local Security Authority (LSA) secret.

Additional Information

The credentials used to log on by default during automatic logon are located under the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

AutoAdminLogon REG_SZ 0 or 1 - Must be zero to remove this feature.

When you use AutoAdminLogon, Windows automatically logs on the specified user when the system is started, bypassing the CTRL+ALT+DEL logon dialog box. This is a serious security problem because anyone can gain access to your computer.

DefaultUserName REG_SZ Username

DefaultPassword REG_SZ Password

Specifies the password for the user listed under DefaultUserName.

If the password that you use for automatic logon is stored programmatically by using the LsaStorePrivateData API, it is encrypted and stored under the following registry keys:

HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets\DefaultPassword\CurrVal

HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets\DefaultPassword\OldVal

By encrypting the password as an LSA secret, you prevent remote users from reading a plaintext password that is stored under the Winlogon registry key. However, anyone with physical access to the computer can boot the system and automatically log on, whether the password is encrypted or in plaintext, which poses a security risk.