Disable Windows 7 auto-login after deployment

Question

I'm deploying a Windows 7 upgrade using the distribution toolkit. After the install, the PC keeps attempting to auto-login as the administrator.

Is there any way to disable auto-login after the lite-touch install? Or possibly just disable it via command-line / registry entry?

Solution

Manually, Open a CMD prompt, in the CMD prompt type Control Userpasswords2 , the first checkbox you see check it. [X] Users must enter a username and password to use this computer.

registry item is:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon

Just as i figured, set to 0 and autologin is disabled, set to 1 and (this is bad) it is re-enabled fully. Tested.
why is that bad? because initialy I had put in a Password that will be used to access the the admin account automatically. By changing ONLY this one registry entry, the AutoPassword is still in the system.

Logically by using the GUI interface, the AutoPassword stored would be removed. Tested, my hunch was right, the GUI method did remove the AutoPassword, and I was unable to autologin without a password, Via just changing the registry item. I was still able to get in after Password error, by supplying the password, after the stored autopassword was removed.

With the registry change, that still leaves removing that protected storage item, the password?? Or a Psudo Admin user (or virus) could set that back to auto pretty quickly, and you should know that.

Side Notes: Also depending on the install, the admin should also be renamed, passworded , and even re-disabled if nessisary for the intended application. if the admin was re-passworded, the stored Auto password should become useless.

I do not really know enough about it, just tested theory.

Comments

[Joe Taylor]

You might want to keep an eye on my question: superuser.com/questions/340396/…

[MDT Guy]

MDT sets an autologin when deploying the OS, if it's not turning off the autologin at the very end, something is wrong. Answer below is just a Band-Aid, not a solution to the root cause. Check you MDT log files and determine what is causing MDT to not turn this off like it should.

[Gaspode]

Ah, that registry key will probably do. Just need to somehow make sure it's merged as the very, very final thing the install does..

[MDT Guy]

Creating a second admin account is a real pain in MDT and unnecessary. If you're really hell bent on securing the device, just create a step in the task sequence to rename it at the very end.