Haiyahhh Hack Vault

Autologon Credentials in Registry

2 min read

🧠 Autologon Credentials in Registry

What is it?

  • Concept: Windows’ “Automatically sign in” feature stores the configured username and password in plaintext in the registry so it can log a user in at boot without prompting — readable by anyone who can query that registry key, regardless of AD/domain membership.
  • Impact: Direct credential disclosure for whatever account autologon was configured with — often a different, more privileged account than the one currently logged in.

How it works

Autologon is implemented by writing DefaultUserName and DefaultPassword (plus DefaultDomainName if applicable) directly into HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon — there’s no encryption or protection on the password value beyond ordinary registry ACLs, which are usually readable by any authenticated local session. This is frequently left behind after a machine was provisioned/imaged with autologon for setup convenience and never cleaned up, or configured for a service that needed a console session under a specific account.

Exploitation

Prerequisites

  • Any authenticated session on the target host (local or remote, e.g. WinRM)

Attack Vectors

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword

Or just check the section WinPEAS surfaces automatically under its Windows Credentials checks — it reads this key as part of a normal run.

Notes

  • Worth checking even when the box doesn’t look domain-joined-suspicious — this is a generic Windows misconfiguration, not an AD-specific one, and shows up on standalone machines too.
  • The account named here is sometimes a different account than the one being used interactively — don’t assume it matches whichever user is currently logged in.

Mitigation

  • Fix: Don’t use registry-based autologon for any account beyond a fully disposable/no-privilege kiosk-style login; if it’s unavoidable, use a Credential Guard-protected mechanism instead of the plaintext Winlogon keys.
FileCreated
HTB - SaunaTuesday, July 21st 2026, 4:41:17 am

References:

Graph View

Backlinks