3

I have enabled autologon in about 150 machines (all in domain) using batch file which uses Sysinternal's Autologon.exe and PSEXEC.exe program. Now I want to disable that in all machines. But It seems like autologon.exe doesn't have a "Disable" option in command line mode. How can I disable autoLogon enabled by AutoLogon.exe through command Line?

| improve this question | | | | |
1

The program autologon.exe itself cannot disable this. However, all autologon.exe does is change some things in the registry. Because of this you could write a script to get rid of these registry settings to run from the command prompt. You would have to edit the sections in this set of entries: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

I know this is the opposite of what you are looking for but use this question for help: How do I change automatic logon via Script or Command Line?

| improve this answer | | | | |
  • I already tried this.. But the AutoLogon.exe will store the password somewhere in registry. Not in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon. Correct ? Could you plz tell me that password key path ? – Sravan May 3 '13 at 10:02
  • 1
    indeed, autologon.exe "" "" "" will disable the autologin again. – eFloh Feb 10 '16 at 9:19
  • Hmm, autologon.exe "" "" "" didn't work for me. – js2010 Aug 30 '18 at 20:08
1

Getting the logon password out of the registry from a remote computer will not be possible according to this: https://keithga.wordpress.com/2013/12/19/sysinternals-autologon-and-securely-encrypting-passwords/

I don't know if it is possible to write a script and run it locally as admin, because a 'reg query' command in an administrative prompt gives an Access Denied.

However you can disable the autologon in the registry in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon by setting AutoAdminLogon to 0 and removing AutoLogonSID

| improve this answer | | | | |
1

This answer contains some new info, so read it to the end.
This application can't disable autologon by just command line, but you can do it with a script, that do exactly the app does (if app's GUI is used for autologon disabling). The app just deletes values DefaultDomainName, DefaultPassword, and DefaultUserName from HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon registry key, and sets AutoAdminLogon value to 0. The app doesn't delete logon password, which stored at LSA secrets, because the password is securely encrypted anyway. But you can delete it, though. It stored at HKLM\SECURITY\Policy\Secrets\DefaultPassword subkeys' default values, so you can delete mentioned key. You must act as SYSTEM for this operation, because that key is protected from users, even administrators.

| improve this answer | | | | |
  • @FleetCommand If one stores the AutoAdminLogon DefaultPassword in LSA it is in fact encrypted and saved under HKLM\SECURITY\Policy\Secrets\DefaultPassword and can be decrypted. In this case it's not just a password hash being stored on the system. – megamorf May 19 '17 at 22:43
  • @megamorf Do you have a source attesting to that too? – user477799 May 21 '17 at 8:30
  • @megamorf I don't know. That article and its script puzzles me to no end and it doesn't help its script doesn't run on Windows 10. – user477799 May 22 '17 at 8:23
0

Autologon by Windows Sysinternals needs to be disabled on each machine individually by running the .exe

| improve this answer | | | | |
0

Building off of green's answer, I was able to successfully remove the autologon by calling this script, located on a shared folder, from the command line:

reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultDomainName /y
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /y
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName /y

The extra argument at the end bypasses the need to confirm each line.

| improve this answer | | | | |
-2

According to the documentation, you should be able to run Autologon.exe again and just hit the "Disable" button. If this is Windows XP, you can try this Microsoft FixIt or the instructions on that site. You could probably also just create a registry file which will delete those keys for you (maybe it's even contained in the FixIt file).

| improve this answer | | | | |
  • 5
    He specifically specified command line mode. No buttons. – Autumnal May 2 '13 at 15:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.