Automatic Logon

Whether automatic logon is on, and whether a password is stored in clear text.

Use it to spot an account set to log on automatically with its password stored in the registry.

SOFTWARE
Defence Evasion

What It Is

Automatic logon is a convenience feature that signs one account in to Windows at start-up without anyone typing a password. Windows reads its values from the Winlogon key in the SOFTWARE hive, where AutoAdminLogon turns it on and DefaultUserName and DefaultDomainName name the account. The password then sits in DefaultPassword in plain text, and Microsoft notes that the Authenticated Users group can read that key remotely. When the Sysinternals Autologon tool sets it up, the password is kept in a Local Security Authority (LSA) secret instead of the Winlogon key.

What It Proves

AutoAdminLogon set to 1 with a DefaultPassword value means Windows signs that account in automatically and the password is held in clear text. Anyone who can read the hive can read it.

What It Does Not Prove

A stored DefaultPassword is readable by admins and anyone with the offline hive. Some kiosks use autologon on purpose, so judge it by the account and where the host sits.

Where It Lives

Automatic Logon lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

C:\Windows\System32\config\SOFTWARE

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in Automatic Logon, each with what it tells you
Registry Value	What It Tells You
`AutoAdminLogon` `REG_SZ1`	Automatic logon is on. Look for DefaultPassword in the same key to see whether a password is stored in clear text.
`DefaultUserName` `REG_SZsvc-reception`	The account set to sign in automatically is svc-reception, not alice. Check ProfileList and event 4624 in the Security log to see whether it has signed in here, and when.
`DefaultPassword` `REG_SZ(clear-text password present)`	A password is stored in clear text. Treat svc-reception as exposed. Remove the value and rotate the password.

How to Read It

Read AutoAdminLogon, DefaultUserName, DefaultDomainName and DefaultPassword under Winlogon. DefaultPassword present means a clear-text password, so treat that account as exposed. To put it right, remove DefaultPassword, set AutoAdminLogon to 0, and rotate the account's password.

When Windows Writes It: When an administrator, a kiosk setup tool, or an attacker with admin rights writes the values.
Which Windows Versions: Windows XP to 11
Tools That Parse It: Registry Explorer, RECmd, RegRipper

Hunt It

Sees It DirectlyDeviceRegistryEvents

Microsoft does not list which Winlogon values Defender records, so confirm these writes appear before relying on it. A DefaultPassword write means a clear-text password sits in the registry, not that anyone signed in with it.

KQLDefender XDR, Advanced hunting

// Automatic logon values written (stored password hidden)DeviceRegistryEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where RegistryKey endswith @"\CurrentVersion\Winlogon"| where RegistryValueName in~ ("AutoAdminLogon", "DefaultUserName", "DefaultPassword")| extend RegistryValueData = iff(RegistryValueName =~ "DefaultPassword", "(hidden)", RegistryValueData)| project Timestamp, ActionType, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessCommandLine| order by Timestamp desc

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Automatic Logon shows.

Local AccountsShows when the account that signs in automatically last logged on, and how often.
Logons, Security Event 4624Not in the RegistryShows whether the account has signed in here, and when.

Sources

The facts on this page come from these public pages, which say more on each point.