AutoLogon credentials

Windows automatic logon lets a machine boot straight into a session without prompting for a password. To do that, the system must store the credentials somewhere, and it does so in the registry under the Winlogon key. Those credentials are usually in plaintext, which makes them a direct prize during post-exploitation.

Where they live. In HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon:

• AutoAdminLogon (1 if autologon is enabled),
• DefaultUserName (the user),
• DefaultPassword (the password, in cleartext),
• sometimes DefaultDomainName.

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" | findstr /i "DefaultUserName DefaultPassword DefaultDomainName AutoAdminLogon"
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword

# over the network, validating the found credential
netexec smb <ip> --local-auth -u <user> -p '<pass>'
netexec smb <ip> -u <user> -p '<pass>'

Why they matter beyond their own user. The real value is not just logging in as that user, but that the password may be reused by a more privileged account. The autologon password very often matches the local Administrator: that is why, after reading it, the next step is to try it against other accounts and services (credential reuse) rather than stopping at the current session.

How to find them. Tools like winPEAS extract them automatically and highlight them in their credentials section; so does a direct reg query, or lazagne. On 32-bit machines you must use the x86 variant of the tool so it reads the correct registry view.

Hint vs proof. Reading a DefaultPassword confirms a valid credential for that user, but its working for Administrator is a hypothesis until validated: check it (e.g. with netexec smb) before assuming the escalation.

How to detect it. Reading the registry barely leaves a trace on its own, so detection lives in the process doing it: a reg query ...\Winlogon, winPEAS or lazagne shows up as Event ID 4688 (process creation, with command-line auditing) touching the Winlogon key. With registry access auditing (a SACL on HKLM\...\Winlogon), reading DefaultPassword also generates a 4657 (a registry value was modified/queried). The most useful signal is not the read but what follows: the reuse of that password, a 4624/4625 for the Administrator account from an unusual host or time right after the key access. Enumeration binaries (winPEAS) get flagged by EDR/AV.

Defence. Avoid autologon on sensitive machines; if unavoidable, use Sysinternals Autologon, which encrypts the password as an LSA secret instead of leaving it cleartext; never reuse the autologon password on administrative accounts. Related to PowerShell history and LSASS dumping.