11

For years I ran Windows 7 without any anti-virus software and got in the habit of turning off my machine at night to lessen the risk of any outside intrusions (like brute force attacks on my network). Now that I am on Windows 10 with more security, I am wondering if there are any benefits to logging out (not shutting down).

My question is simple; what are the security benefits of logging out in Windows 10?

Perhaps someone also might explain the different benefits of logging off VS locking session

4
  • 13
    As a technical term, "logging out" is a very different thing from turning off the machine. Are you still asking about the latter? Jul 30, 2020 at 8:25
  • 6
    There's also locking the session, which is also different from these two.
    – gronostaj
    Jul 30, 2020 at 8:28
  • @user1686 good distinction. I am talking about logging off. Jul 30, 2020 at 8:46
  • 2
    It's impossible to brute-force a home network provided a few simple things are done: (1) Router capable of running opensource firmware [OpenWrt], as most routers rarely see a firmware update, considered End-of-Life by the OEM after 1yr; (2) Ensure UPnP is turned off on the router; (3) Only WPA2 CCMP [AES] & above is secure to use (do not use TKIP or enable WPS); all passphrases (admin, WiFi, etc.) should be a min 16char containing at least 2 of each: uppercase, lowercase, numbers, & symbols; (4) Place IoT devices and smartphones/tablets on their own separate VLAN networks separate from LAN
    – JW0914
    Jul 30, 2020 at 12:12

3 Answers 3

6

There are several things you need to know before:

  • Lock: It will lock the computer, but all the user's program will keep running. Lock can be triggered with Windows Key+L or CTRL+ALT+DEL > Lock.
  • Disconnect session: It is simillar to lock, will lock the computer and keep User programs running and let other users log in using Remote desktop or physically. It is similar to Switch User when done physically.
  • Log out: Close all programs of the user and log out. It is different from disconnecting session, because this will not allow users to connect session from Remote dekstop, only physically another user will log in.
  • Turn off/Shut down: Will close all running programs of current user, if another user is logged in then prompt to turn them off also. Then the computer will switched off and offline.
  • Power off: Cutting down the power supply when computer is active. It is dangerous, you will lose your unsaved data or files may get corrupted.

When you lock workstation, it will keep all programs running, and if any kinds of virus/trojans are running they will function as is.

And if you log out and before save all of your work, you are safe because no program can run then and none can remotely connect to your account, without credentials.

Note: If you log out, services or scheduled tasks may continue to run as @jcaron said. But many programs can run as services, so you have to look on which services are running and stop which you are suspecting. They can also run as scheduled tasks.

8
  • 6
    You use the word "account" but don't explain what part of the account you're speaking of, and logging out does not prevent remote access to the files of that account. It is other parts of the system that do that. Your answer says WHAT happens when given star changes are made, but it doesn't discuss the security implications of these. Jul 30, 2020 at 18:52
  • 5
    "no program can run"... That's quite incorrect. Services continue to run. Scheduled tasks can run.
    – jcaron
    Jul 31, 2020 at 8:30
  • Programs can be run as services or tasks ... They're not the same, but I think you see my point.
    – GChuf
    Jul 31, 2020 at 8:37
  • 3
    "Log out" WILL allow users to connect with RDP. Connecting with RDP will simply log you in with new session. Jul 31, 2020 at 11:57
  • 1
    @Wasif_Hasan that's how it always work. You can't just RDP into logged-in session without correct credentials. You need them in any case. Jul 31, 2020 at 12:33
14

The primary benefit is that any data associated with your user session that's in memory will be unloaded from memory when you log out.

This sounds kind of stupid, until you consider that by default Windows caches credentials secured by your account password in memory on first use and does not tend to drop that cache until you log out. Such credentials include, but are not necessarily limited to: stuff like the master encryption key used to protect the encryption keys used for the native transparent file encryption support built into Windows and login credentials for any network shares you have accessed (including both mapped drives and regular UNC share access, you can explicitly drop these by manually disconnecting from the drives/shares in either CMD or PowerShell using the net use command).

11
  • This sounds plausible, but if keeping that data in memory was a security issue, why was the system designed that way?
    – CodeCaster
    Jul 30, 2020 at 17:29
  • 2
    @CodeCaster It's a matter of security versus convenience. You can configure Windows to not cache some of this (the encryption keys for example) and require a password on each access, but in some cases like the network shares thing, it's simply baked into how the OS actually works because they want it to work with minimal effort and maximal convenience for everybody. Jul 30, 2020 at 17:30
  • 2
    Of note, Windows does actively zero out memory when a process exits (and will not reallocate that memory until zeroed), so logging out does actually remove user data from RAM. (Contrast with eg deleting a file, where the space is deallocated but the data remains on disk. However, it is unclear whether this means memory which was paged out to disk is also zeroed on disk.) This means that any information held by open apps is securely removed when you log out.
    – josh3736
    Jul 31, 2020 at 1:35
  • 1
    @josh3736 Given that there's a GPO option to specifically wipe the page file on shutdown, I'm pretty sure that anything that's been paged out to disk does not get wiped by default. This is one of the big reasons to want to encrypt the page file (which Windows also does not do by default). Jul 31, 2020 at 1:40
  • 1
    @JW0914 At least historically it did not. I'm not sure if current versions will leverage things like SGX or SME for storing credentials or not. Jul 31, 2020 at 12:57
6

To further specify your question, correct me if I'm wrong:

Assuming you let a machine sit idle after using it, is there an additional security benefit to logging off, in terms of network attacks?

The theoretical answer is "yes". Software that is running when you are logged in can pose a security threat by receiving network traffic that exploits vulnerabilities in said software. When that software is running in your user space, that vulnerability goes away when you log off.

For example, you can infect your machine by visiting a malicious site with your browser. This site triggers some vulnerability in your browser and compromises your system. Leaving the browser open overnight does have the same risk: a site that you have opened could load new content using JavaScript or other means that exploits a vulnerability in your browser.

That's for outgoing connections, but incoming connections can pose the same threat. That is, if your router and firewall (if any, and enabled) allow them to even reach your machine and get sent to the listening application.

There are countless of other programs that could be running after you've used the machine, each of which could have networking functionality (either listening for traffic or actively communicating with other servers) that could contain vulnerabilities.

Even if you kill all visible applications, there is always something extra running that could theoretically get attacked while you are logged on.

Logging off stops these programs.

Logging off also sets the baseline: when your machine displays the login screen, countless of background programs (services) are running, a lot of which can still invoke network traffic and get attacked.

And if your machine is idle and nobody will be using it for hours anyway, why not turn it off completely?

6
  • 1
    Specific to the first paragraph (exploiting a 3rd party software vulnerability over the network), that would require a few things to have been manually changed on Windows and doesn't appear at face value as something 99.99% of folks would be concerned with due to it's complexity [Occam's Razor]: Windows' firewall blocks inbound traffic by default, as do most, if not all, 3rd party firewalls, and all routers block all inbound WAN traffic by default. Due to the complexities involved, this would have to be a targetted attack on a specific individual and not apply to 99.99% of folks.
    – JW0914
    Jul 31, 2020 at 13:06
  • 1
    Software can ask for allowing a firewall rule upon installation or startup. Software can use UPNP, hole punching and so on to also allow incoming connections. Malicious payloads can be received in response to an outgoing connection.
    – CodeCaster
    Jul 31, 2020 at 13:14
  • Right, but it's not open-ended access... an attacker would still have to know precisely how to exploit what the software is expecting to receive and what it can receive. Additionally, while traffic can be inbound to the software, it must be initiated on the software to pass through a WAN firewall, unless specific port redirects have been configured within a router's stateful firewall to allow inbound WAN traffic, and such a redirect would have to be on the port(s) the software is expecting communication on. This is simply not a practical concern for 99.99% of users.
    – JW0914
    Jul 31, 2020 at 14:47
  • I mention one example in my answer, a browser that has a site open. Another example is chat software, or software that phones home to download updates. Each of those sources could be compromised, attacking all connected clients at once. This is not a 0.01% case, this is a very real threat. Logging off, closing that software, eliminates that threat.
    – CodeCaster
    Jul 31, 2020 at 14:50
  • By that definition, every smartphone and tablet is insecure and should be powered off when not in use (defeating the purpose of the device)... there are fundamental issues/flaws with that specific example. Can what you're describing happen, yes, is it likely or a practical attack, no. I understand the point you're making, I disagree with the practicality of it in this specific use case scenario as it's far too complex, requiring too many factors to be just right that it would have to be a targetted attack (again, Occam's Razor).
    – JW0914
    Jul 31, 2020 at 14:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .