Detections
Analytics

Microsoft Windows SMB Registry : Autologon Password Exposed

high Nessus Plugin ID 367860

Synopsis

Autologon Password Exposed

Description

This script determines whether the autologon feature exposes a password

Solution

Delete the keys AutoAdminLogon and DefaultPassword under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

See Also

http://support.microsoft.com/kb/315231

Plugin Details

Severity: High

ID: 367860

File Name: smb_autologon_exposure.nasl

Version: 1.1

Type: Local

Agent: windows

Family: Windows

Published: 10/20/2026

Updated: 10/20/2026

Supported Sensors: Nessus Agent, Nessus

Risk Information

CVSS Score Rationale: Score based on analysis of the vendor advisory

CVSS v2

Risk Factor: High

Base Score: 7.2

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: manual

CVSS v3

Risk Factor: High

Base Score: 8.4

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

Required KB Items: SMB/name, SMB/login, SMB/password, SMB/registry_access, SMB/transport, Host/Autologon_exposure