8

Obviously, if auto-logon is enabled, anyone who can gain physical access to the PC can use the PC. That's not the question.

The question is, when I enable auto-logon for my Windows 7 box, will there be any additional security problems?

Does the setting "Users must enter a user name and password to use this computer." affect anything else? Where/how is the password stored for auto-login?

Note: This is specifically for Windows 7, as I found this little gem regarding XP:

Additionally, if you turn on automatic logon, the password is stored in the registry in plain text. The specific registry key that stores this value is remotely readable by the Authenticated Users group.

Disclaimer: This is for my home desktop PC. Not a laptop. Not work related.

Improve this question
6
  • I have had Windows 7 automatically log me in since I installed it. I have not once had a problem with security. Of course I go to other extreme measures and limit the powers of the account in question although one could argue this really isn't required.
    – Ramhound
    Dec 28, 2011 at 12:32
  • @Ramhound - I found the bit about Windows XP storing the password plaintext in the registry especially disturbing. Do you happen to know whether this is different with Win7?
    – Martin
    Dec 28, 2011 at 13:25
  • Why exactly do you find it disturbing? I assume you are worried about the case where the computer ( Windows XP ) is infected, and malware uses the plaintext password to increase its privilages, in order to perform some malicious act. What you forget is that, this same malware could simply record the password ( trivial task ), and perform the same action. I feel the risks of running as a user level account and super user/administrator level account are exactly the same in todays environment. Every malicious file I have come across would effect the system in exactly the same way.
    – Ramhound
    Dec 29, 2011 at 15:40
  • My comments about super user vs user is with regards to Windows 7.
    – Ramhound
    Dec 29, 2011 at 15:41
  • I find it disturbing because my password is being stored plain text. That means everything/one with read access to this registry location can use this info to log in remotely with these credentials. So a malicious piece of code that only yet has read access, can suddenly turn into a malicious p.o.c. that knows valid credentials for this machine.
    – Martin
    Jan 7, 2012 at 19:41

4 Answers 4

Reset to default
4

The question is, when I enable auto-logon for my Windows 7 box, will there be any additional security problems?

Not as long as there's nothing reading your registry and distributing the there stored credentials to a (probably malicious) party.

Does the setting "Users must enter a user name and password to use this computer." affect anything else?

I have yet to discover the first person running software that's limited to NOT have READ access to the registry. So - in practice - any software could read the credentials from the registry, if it was made to and given the correct (UAC) credentials to run. Which will be the case in 99.99%.

Now, if one of the "software" things running were "malware", all it would need is a short transmission over the internet to pass your credentials to a 3rd party. In a worst-case scenario, without your knowledge. Using those credentials, people could try to access your system from outside (network/internet) and use your machine with the same User Access level you have given the auto-login account.

Where/how is the password stored for auto-login?

Windows registry, in "plain text".

A security tip from my side, since no one said it yet...

Auto-login can be useful. But please don't say your auto-login account has "admin" level. If it has, CHANGE THAT to something more restricted and more harmless... just in case!

Improve this answer
7

SystInternals autologon stores credentials in LSASecret registry area that could be easily extracted by 3rd party tool (google for them) The only secure solution I found is Logonexpert that encrypts login/pass using AES256

Improve this answer
3
  • 3
    If the password can be decrypted to be used in a logon then whether it's stored as an LSA secret or encrypted with AES256 is irrelevant-- the plaintext is on the machine, effectively speaking. The AES256 bit just means than an attacker has to rip up the Logonexpert software to get it to decrypt the password for him.
    – Evan Anderson
    Dec 31, 2011 at 0:49
  • LSASecret is safe from non-administrator's IIRC
    – Nathan Goings
    Oct 6, 2015 at 19:31
  • @NathanGoings One more reason not to use admin account in autologin: once you have admin rights, that secret becomes effectively plain text.
    – Dmitry Grigoryev
    Dec 9, 2015 at 15:36
6

Auto login works by storing the credentials in the registry in plain text. Once the winlogon.exe process has finished loading it checks for those particular registry values. If they exist, Windows logs on with those credentials. It's as if a user typed the same credentials in themselves.

It's usually designed to be used in a kiosk style mode, with user accounts that have limited access to the network or local machine.

Is it secure? No. Your user password is stored in plain text in the registry. This was designed for kiosk-style systems for accounts with limited access.

Improve this answer
3

If you decide to use autologon, I'd suggest you at least use the SystInternals Utility Autologon.

That way it is at least not stored in plaintext and (somewhat) secured.

Note: It is stored as a LSA secret. http://blogs.technet.com/b/doxley/archive/2009/04/22/safely-setting-autologon-for-windows.aspx

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.