AutoAdminLogon, worth the extra risk?

What is AutoAdminLogon, and its benefits?

AutoAdminLogon is a Windows registry setting which automates the logon process of a specific user account during system startup, bypassing the typical login screen. Enabling this setting streamlines the startup process, being particularly useful in scenarios where a system needs to boot up and immediately launch specific applications or services without manual intervention.

It can simplify tasks such as automated system updates, batch processing, or kiosk setups in environments where users don’t frequently log in/out or where multiple systems are deployed for a specific task.

Anonymous Logon: Understanding the Security Battleground with NT Authority

Why have AutoAdminLogon set to "disabled"

Enabling AutoAdminLogon on a system grants unrestricted access to anyone with physical access to the machine, allowing potential access to all information stored on the machine itself, as well as any networks it may be connected to.

Additionally if enabled, the password is stored in the registry in plaintext, accessible remotely by the Authenticated Users group. Therefore, it is vital to ensure, if enabled, that the system is physically secured, and checks are in place to guarantee that untrusted users cannot remotely view the registry.

What will happen if AutoAdminLogon is "disabled"?

When restarting or booting up a system with AutoAdminLogon disabled, it will not automatically login, instead the Windows login screen will be presented and a username and password must be manually entered in order to gain access to the account.

Secure Boot in Windows: A Step-by-Step Guide to Enable or Disable

AutoAdminLogon Vulnerabilities

Having AutoAdminLogon enabled increases the possibility of an unauthorized entity accessing the system and any connected networks.

Consequences of unrestricted access can be:

• Data breaches
• Data manipulation and corruption
• Malware installation
• Resource theft
• Privilege escalation
• Disruption of services
• Backdoor creation
• Legal and compliance issues

Steps to disable AutoAdminLogon

To establish the recommended configuration via GP, set the following UI path to Disabled:

Note: This Group Policy path does not exist by default. An additional Group Policy template (MSS-legacy.admx/adml) is required – it is available from this TechNet blog post: The MSS settings - Microsoft Security Guidance blog.

Policy setting via GPO

MSS: (AutoAdminLogon) Enable Automatic Logon ( not recommended)                                                                                 

Default

The default setting for AutoAdminLogon is "Disabled".

How to enable AutoAdminLogon

The following instructions detail how to enable AutoAdminLogon as provided from Microsoft:

To use Registry Editor to turn on automatic logon, follow these steps:

1. Select Start, and then select Run.
2. In the Open box, type Regedit.exe, and then press Enter.
3. Locate the: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon subkey in the registry.
4. On the Edit menu, select New, and then point to String Value.
5. Type AutoAdminLogon, and then press Enter.
6. Double-click AutoAdminLogon.
7. In the Edit String dialog box, type 1 and then select OK.
8. Double-click the DefaultUserName entry, type your user name, and then select OK.
9. Double-click the DefaultPassword entry, type your password, and then select OK.
   If the DefaultPassword value doesn’t exist, it must be added. To add the value, follow these steps:
   1. On the Edit menu, select New, and then point to String Value.
   2. Type DefaultPassword, and then press Enter.
   3. Double-click DefaultPassword.
   4. In the Edit String dialog, type your password and then select OK.

Note: If no DefaultPassword string is specified, Windows automatically changes the value of the AutoAdminLogon key from 1 (true) to 0 (false), disabling the AutoAdminLogon feature.

1. If you have joined the computer to a domain, you should add the DefaultDomainName value, and the data for the value should be set as the fully qualified domain name (FQDN) of the domain, for example contoso.com..
2. Exit Registry Editor.
3. Select Start, select Shutdown, and then type a reason in the Comment text box.
4. Select OK to turn off your computer.
5. Restart your computer. You can now log on automatically.

Best Practices

While disabling AutoAdminLogon might not always be optimal in specific scenarios such as automated system updates, batch processing, or kiosk setups, for many it is important that AutoAdminLogon is set to disabled when possible, in order to mitigate potential security threats.

Hardening the system provides another layer of protection against unauthorized access, especially if the computer is in a shared environment or there are concerns regarding potential security risks.