Detections
Analytics

4.5.1 (L1) Ensure 'MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)' is set to 'Disabled'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This setting is separate from the Welcome screen feature in Windows XP and Windows Vista; if that feature is disabled, this setting is not disabled. If you configure a computer for automatic logon, anyone who can physically gain access to the computer can also gain access to everything that is on the computer, including any network or networks to which the computer is connected. Also, if you enable automatic logon, the password is stored in the registry in plaintext, and the specific registry key that stores this value is remotely readable by the Authenticated Users group.

For additional information, see Microsoft Knowledge Base article 324737:

How to turn on automatic logon in Windows

.

The recommended state for this setting is: Disabled

If you configure a computer for automatic logon, anyone who can physically gain access to the computer can also gain access to everything that is on the computer, including any network or networks that the computer is connected to. Also, if you enable automatic logon, the password is stored in the registry in plaintext. The specific registry key that stores this setting is remotely readable by the Authenticated Users group. As a result, this entry is appropriate only if the computer is physically secured and if you ensure that untrusted users cannot remotely see the registry.

Solution

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to `Disabled.

Administrative Templates\MSS (Legacy)\MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)

Impact:

None - this is the default behavior.

Warning:

Windows Autopilot - Policy Conflicts

: Windows Autopilot pre-provisioning doesn't work when this policy setting is Disabled

If Windows Autopilot is used in the environment, assign this setting exclusively to user groups rather than device groups. This ensures the setting is applied later during enrollment, allowing Windows Autopilot to complete its pre-provisioning process and prevent potential interruptions.

See Also

https://workbench.cisecurity.org/benchmarks/21767

Item Details

References: CSCv7|16.4

Plugin: Windows

Control ID: f11f56cb4e029e63858ad3d48778f6e83592e746569e9223601123c384ccf7a0