Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Obviously, if auto-logon is enabled, anyone who can gain physical access to the PC can use the PC. That's not the question.

The question is, when I enable auto-logon for my Windows 7 box, will there be any additional security problems?

Does the setting "Users must enter a user name and password to use this computer." affect anything else? Where/how is the password stored for auto-login?

Note: This is specifically for Windows 7, as I found this little gem regarding XP:

Additionally, if you turn on automatic logon, the password is stored in the registry in plain text. The specific registry key that stores this value is remotely readable by the Authenticated Users group.

Disclaimer: This is for my home desktop PC. Not a laptop. Not work related.

share|improve this question
    
I have had Windows 7 automatically log me in since I installed it. I have not once had a problem with security. Of course I go to other extreme measures and limit the powers of the account in question although one could argue this really isn't required. –  Ramhound Dec 28 '11 at 12:32
    
@Ramhound - I found the bit about Windows XP storing the password plaintext in the registry especially disturbing. Do you happen to know whether this is different with Win7? –  Martin Dec 28 '11 at 13:25
    
Why exactly do you find it disturbing? I assume you are worried about the case where the computer ( Windows XP ) is infected, and malware uses the plaintext password to increase its privilages, in order to perform some malicious act. What you forget is that, this same malware could simply record the password ( trivial task ), and perform the same action. I feel the risks of running as a user level account and super user/administrator level account are exactly the same in todays environment. Every malicious file I have come across would effect the system in exactly the same way. –  Ramhound Dec 29 '11 at 15:40
    
My comments about super user vs user is with regards to Windows 7. –  Ramhound Dec 29 '11 at 15:41
    
I find it disturbing because my password is being stored plain text. That means everything/one with read access to this registry location can use this info to log in remotely with these credentials. So a malicious piece of code that only yet has read access, can suddenly turn into a malicious p.o.c. that knows valid credentials for this machine. –  Martin Jan 7 '12 at 19:41

4 Answers 4

up vote 4 down vote accepted

The question is, when I enable auto-logon for my Windows 7 box, will there be any additional security problems?

Not as long as there's nothing reading your registry and distributing the there stored credentials to a (probably malicious) party.

Does the setting "Users must enter a user name and password to use this computer." affect anything else?

I have yet to discover the first person running software that's limited to NOT have READ access to the registry. So - in practice - any software could read the credentials from the registry, if it was made to and given the correct (UAC) credentials to run. Which will be the case in 99.99%.

Now, if one of the "software" things running were "malware", all it would need is a short transmission over the internet to pass your credentials to a 3rd party. In a worst-case scenario, without your knowledge. Using those credentials, people could try to access your system from outside (network/internet) and use your machine with the same User Access level you have given the auto-login account.

Where/how is the password stored for auto-login?

Windows registry, in "plain text".

A security tip from my side, since no one said it yet...

Auto-login can be useful. But please don't say your auto-login account has "admin" level. If it has, CHANGE THAT to something more restricted and more harmless... just in case!

share|improve this answer

Auto login works by storing the credentials in the registry in plain text. Once the winlogon.exe process has finished loading it checks for those particular registry values. If they exist, Windows logs on with those credentials. It's as if a user typed the same credentials in themselves.

It's usually designed to be used in a kiosk style mode, with user accounts that have limited access to the network or local machine.

Is it secure? No. Your user password is stored in plain text in the registry. This was designed for kiosk-style systems for accounts with limited access.

share|improve this answer

SystInternals autologon stores credentials in LSASecret registry area that could be easily extracted by 3rd party tool (google for them) The only secure solution I found is Logonexpert that encrypts login/pass using AES256

share|improve this answer
    
+1 for a seemingly interesting product –  Martin Dec 30 '11 at 19:19
1  
If the password can be decrypted to be used in a logon then whether it's stored as an LSA secret or encrypted with AES256 is irrelevant-- the plaintext is on the machine, effectively speaking. The AES256 bit just means than an attacker has to rip up the Logonexpert software to get it to decrypt the password for him. –  Evan Anderson Dec 31 '11 at 0:49

If you decide to use autologon, I'd suggest you at least use the SystInternals Utility Autologon.

That way it is at least not stored in plaintext and (somewhat) secured.

Note: It is stored as a LSA secret. http://blogs.technet.com/b/doxley/archive/2009/04/22/safely-setting-autologon-for-windows.aspx

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.