.Net: Windows Auto Logon Fix!

terrill wrote on 5/5/2004, 6:34 AM
Since my original reply yo another thread is difficult to find, I started a "new thread."

Since the installation by Sony of .NET Framework causes Windows XP to bring up the logon screen during boot-up (or reboot), here's the fix:

1. You can read the original step-by-step artice at MicroCrap.com here:

http://support.microsoft.com/default.aspx?scid=kb;en-us;315231&Product=winxp

1a. If the above link doesn't work, search for article ID: 315231

2. In a nutshell (copied directly from the above-mentioned article):

a. Click Start, click Run, type regedit,and then click OK to start Registry Editor.

b. Locate the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon

c. Using your account name and password, double-click the DefaultUserName entry, type your user name, and then click OK.

d. Double-click the DefaultPassword entry, type your password under the value data box, and then click OK.

If there is no DefaultPassword value, follow these steps to create the value:

e. On the Registry Editor menu, click Edit, click New, and then click String Value.

f. Type DefaultPassword as the value name, and then press ENTER.
Double-click the newly created key, and then type your password in the Value Data box.

If no DefaultPassword string is specified, Windows automatically changes the value of the AutoAdminLogon key from 1 (true) to 0 (false) to disable the AutoAdminLogon feature.

g. Double-click the AutoAdminLogon entry, type 1 in the Value Data box, and then click OK.

If there is no AutoAdminLogon entry, follow these steps to create the entry:

g.1. On the Registry Editor menu, click Edit, click New, and then click String Value.

g.2 Type AutoAdminLogon as the value name, and then press ENTER.

h. Double-click the newly created key, and then type 1 in the Value Data box.

i. Quit Registry Editor.

j. Click Start, click Restart, and then click OK.

k. After your computer restarts and Windows starts, you can log on automatically.

Yeah, Thanks SONY for:

1. Adding crap to my system I didn't want without warning.

2. Changing existing settings without warning.

3. Not tell us, your daily-paycheck, how to fix the problem or supplying a simple .reg file we could modify using Notepad, and instructions on how to import it.

4. Making us, your daily-paycheck, seek answers elsewhere to fix the problems YOU created.

Enjoy! It's a wonderful life, eh?

-- terill --

"Security must be evaluated not based on how it works, but on how it fails."
-- Bruce Schneier
http://www.schneier.com/essay-034.html

Comments

farss wrote on 5/5/2004, 7:09 AM
Let me see if I've got this right. You had an XP system that had NO logon security, just booted straight up into a user account with admin priveleges, not even so much as having to press enter to login. Then you added .NET and that created another user account which at least had some degree of security by requiring you to press enter and now you've removed even that paltry level of security and you figure you're safer?
Maybe I'm wrong but it seems to me you need to read more of Bruce's essays.
daryl wrote on 5/5/2004, 7:11 AM
THANK YOU Terill! I'll be fixing the logon to my PC soon as I get home, my wife is annoyed by it as well.

I USED to be a Microsoft fan, 'till they got so arrogant that they decided they should do things automatically that THEY think we want. YEA LINUX!

Oh, and the "To prevent this message in the future, please shut down you computer properly", you know, it's hard to shut it down properly when all you see is BLUE!

OK, I feel better now.
terrill wrote on 5/5/2004, 9:32 AM
Never said I feel safer, now did i? Nope!

I also never said it was an Admin account, now did I? Nope!

In relation to lessons from Bruce's essay's: that silly button is about as useful from preventing attacks on my laptop or home computer as checking ID's at the airport... security theater, with no real value! Either my home computer is protected through diligent security measures, or it isn't. And if it isn't, it doesn't matter if I manually click a button or not. Now, does it?

"Security must be evaluated not based on how it works, but on how it fails."
-- Bruce Schneier
http://www.schneier.com/essay-034.html
johnmeyer wrote on 5/5/2004, 10:21 AM
farss,

I hate to be the bearer of bad news, but the logon user name/password is actually the easiest of all security measures to defeat. There are a number of exploits, including one involving a screen saver. I had to get into a WinNT laptop because the user had lost his password, and the IT guy was playing the ultimate power trip, "punishing" him by refusing to come and fix it. In ten minutes, using an exploit I found on the first page of a Google search, I was logged into his system. Prior to that, I had never hacked a computer in my life. (Actually, that is not true. I had to recover one of my own internal passwords on a Win98 computer four years ago, and my 16-year-old nephew emailed a hack tool to me that revealed every password on my computer. It was like something out of a Hollywood movie -- there they all were, laid out in the open).

The only protection you have against data or program loss is backup. Do it daily, and use many, many different backup sets. Protection against intrusion? You can lock your doors, but they will still break in through the windows. Same thing with computers.

You should still lock your doors, of course ...
prairiedogpics wrote on 5/5/2004, 1:57 PM
I'll chime in by saying tha I find having to click on my user name to boot up completely to be VERY ANNOYING, and was miffed to find this after installing .net.

I don't mind that Sony requires the install. But I am annoyed at MS requiring an extra step. I'm a home user, after all, and I can monitor security pretty closely (since I'm the only one who starts up the computer.)
JohnnyRoy wrote on 5/5/2004, 2:08 PM
> Then you added .NET and that created another user account which at least had some degree of security

Actually, exactly the opposite is true. .NET secretly adds an ACTIVE user account on your system called ASPNET. Now everyone who has installed the .NET Framework has an active “well known” userid on their PC for any hacker to attack! At least before a hacker had to guess what your userid was and then guess your password. Now they only need to guess the password for ASPNET to break into your system. (if, in fact, it even has a password. I can’t check because I deleted it as soon as I found it!)

The correct security fix is not hiding ASPNET but actually disabling it.

~jr
farss wrote on 5/6/2004, 4:30 AM
My apologies,
I did forsee pretty much what you're saying as being the case. My concern was more at people who just have their systems boot up into an admin account. I agree most of the 'security' measures at best do nothing more than deter the idly curious. So long as so many regard security as a hinderance to getting on with it I think no matter what uStuff or any OS vendor does they'll never achieve any real progress.