2

This question has an overlap with programming, but I think it primarily belongs here. I'm building an elaborate script in AutoIt that switches on autologon so that multiple unattended reboots are possible. I also check if autologon was already switched on, and if so, I do nothing.

If not, however, I ask for a password, check if the password is valid by a call to the LogonUser API of advapi.dll, then I set the following registry settings as per http://support.microsoft.com/kb/324737/ 

RegWrite('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon', 'AutoAdminLogon', 'REG_DWORD', 1)
RegWrite('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon', 'DefaultUserName', 'REG_SZ', $username)
RegWrite('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon', 'DefaultPassword', 'REG_SZ', $password)

Normally, this works just fine. However, somebody working in the field just reported that my script asks for a password on a computer running Windows 7 Professional which already had autologon enabled.

When I check the registry, under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, I don't find any of the required keys, i.e. AutoAdminLogon, DefaultUserName and DefaultPassword.

When I run netplwiz, that also states that 'users must enter a username and a password' to login; the checkbox is checked.

So what's going on here? Is this even possible? Is there another autologon mechanism out there? How does it work and how do I detect it? Unfortunately this is just one machine in the field, and I don't have access to it now. I only got one look; through TeamViewer. Any help appreciated.

Michiel de Boer
  • 21
  • 2
  • Writing to `HKLM` registry hive might require administrator rights and/or elevated privileges... – JosefZ Jan 14 '15 at 20:40
  • Ah, thanks for the reply. Well... firstly, the program requires Admin privileges, so that couldn't be the issue; secondly the code flow 'concludes' (erroneously) that the system isn't configured for Autologon by _reading_ the registry; and thirdly: both netplwiz and manually checking with regedit reveal the keys required for Autologon to be active and working... aren't there. – Michiel de Boer Jan 15 '15 at 11:17
  • Is the machine standalone with only a single local user account and no password set? In that scenario, Windows will simply autologin. – fencepost Feb 03 '15 at 23:09

1 Answers1

0

Not sure if you've solved this or not, but Technet documents that AutoAdminLogon is REG_SZ. You're creating it as REG_DWORD.

See: https://technet.microsoft.com/en-us/library/Cc939702.aspx

Certainly explains why certain apps (like netplwiz) might think it is enabled - it might be okay with either REG_DWORD or REG_SZ, while other parts of Windows (like the boot sequence) might be more stringent, and require REG_SZ.

Lynn Crumbling
  • 101
  • 3