0

I have just configured my Windows 10 desktop PC at home to automatically log into my Windows 10 user account that my Microsoft account is linked to on startup. My desktop is in my bedroom upstairs and I trust my parents who I live with to not snoop around. However, I was wondering if this could have any security concerns beyond "your account is essentially passwordless when starting your PC". For example, could someone abuse this usability change to steal my Microsoft password after logging in? Could someone do so through a malicious website? Could someone do so through a backdoor in an app?

In other words: which security risks does enabling automatic authentication on startup on a Windows 10 machine using a Microsoft account bring beyond guaranteeing an attacker with physical access to a non-booted machine can access my machine?

Improve this question

1 Answer 1

Reset to default
0

The main implication is what you said, an attacker with physical access has full access to everything on the PC and your Microsoft account.

For security-relevant operation on your Microsoft account, MS still asks for the password, so the most important operations (like changing password or email) can not be done via auto-login alone.

If do you have a password set and autologin enabled I see just one issue in a normal private household environment where targetted attacks are highly unlikely.

If there is a break in and someone steals the machine, they also have access to it.

How much this risk means to you, only you can decide.

Improve this answer
6
  • I'm more concerned about something like a dodgy browser extension or a malicious app or someone abusing a buggy app somehow managing to read wherever it is that Windows stores the retained password. Isn't it stored in the registry, possibly in plaintext? Because the guide I consulted mentioned that was an alternative way to manually configure autologin if the method through netplwiz doesn't work.
    – Nzall
    Jan 13, 2020 at 19:56
  • @Nzall There might be a hashed copy of your password in the C:\Windows\System32\config directory in one of those files. I'm not exactly sure how MS handles login for Online accounts, but I'm assuming they keep a copy of the password for offline login.
    – user
    Jan 13, 2020 at 19:59
  • The password hash is in C:\Windows\System32\config\SAM and is encrypted with the boot key from C:\windows\system32\config\system. Windows hold exclusive locks on both files while it is running. However, the hash can also be extracted from memory (which multiple password extraction tools do)
    – fleitner
    Jan 13, 2020 at 20:39
  • @Nzall Dodgy applications can do this regardless of whether autologin is enabled or not. The important thing, in my opinion, is that you use a password and enable autologin, and not just use no password. Administrative rights are required to extract password hashes from memory (it will take all hashes, not just from your account). Therefore having a password set will prevent this from happening without you noticing.
    – fleitner
    Jan 13, 2020 at 20:44
  • Thanks for the explanation. As for the potential of theft: does Windows 10 Home edition have a built-in or otherwise free way to remotely initiate a machine wipe?
    – Nzall
    Jan 13, 2020 at 22:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .