Auto-logon: securing the registry

[AlanN]

Hi there,

We have some servers i'd like to auto-login - though most of what they do
runs as a service, some legacy desktop applications point blank refuse to
play nicely and must be run under a domain account. As the servers are on a
domain, the control userpasswords2 method of auto-logon will not work (the
options do not appear on a domain machine). TweakUI would be overkill and a
pain to roll out, so the registry is our only option.

If we were to restrict the Winlogon key in the registry to the local admins
group via ACL, what's the worst that could happen? (Please bear in mind that
the only people who ever access this server do it via a local intranet site
over the anonymous IUSR account, and people in the local admins group).
Thanks!

 

[Dave Patrick]

Use the reghack in these articles.


How to Enable Automatic Logon in Windows NT
http://support.microsoft.com/default.aspx?scid=kb;[LN];97597

How to Enable Automatic Logon in Windows 2000
http://support.microsoft.com/default.aspx?scid=kb;[LN];234562

How to Enable Automatic Logon in Windows Server 2003
http://support.microsoft.com/default.aspx?scid=kb;[LN];324737


--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"AlanN" wrote:
> Hi there,
>
> We have some servers i'd like to auto-login - though most of what they do
> runs as a service, some legacy desktop applications point blank refuse to
> play nicely and must be run under a domain account. As the servers are on
> a
> domain, the control userpasswords2 method of auto-logon will not work (the
> options do not appear on a domain machine). TweakUI would be overkill and
> a
> pain to roll out, so the registry is our only option.
>
> If we were to restrict the Winlogon key in the registry to the local
> admins
> group via ACL, what's the worst that could happen? (Please bear in mind
> that
> the only people who ever access this server do it via a local intranet
> site
> over the anonymous IUSR account, and people in the local admins group).
> Thanks!

 

[AlanN]

Hi Dave,

Thanks for the reply, but I don't think you've read my OP!

I'm looking to secure the hacks below a little. Could you have another read
of my suggestion and let me know your thoughts?

Thanks,

Alan

"Dave Patrick" wrote:

> Use the reghack in these articles.
>
>
> How to Enable Automatic Logon in Windows NT
> http://support.microsoft.com/default.aspx?scid=kb;[LN];97597
>
> How to Enable Automatic Logon in Windows 2000
> http://support.microsoft.com/default.aspx?scid=kb;[LN];234562
>
> How to Enable Automatic Logon in Windows Server 2003
> http://support.microsoft.com/default.aspx?scid=kb;[LN];324737
>
>
> --
>
> Regards,
>
> Dave Patrick ....Please no email replies - reply in newsgroup.
> Microsoft Certified Professional
> Microsoft MVP [Windows]
> http://www.microsoft.com/protect
>
> "AlanN" wrote:
> > Hi there,
> >
> > We have some servers i'd like to auto-login - though most of what they do
> > runs as a service, some legacy desktop applications point blank refuse to
> > play nicely and must be run under a domain account. As the servers are on
> > a
> > domain, the control userpasswords2 method of auto-logon will not work (the
> > options do not appear on a domain machine). TweakUI would be overkill and
> > a
> > pain to roll out, so the registry is our only option.
> >
> > If we were to restrict the Winlogon key in the registry to the local
> > admins
> > group via ACL, what's the worst that could happen? (Please bear in mind
> > that
> > the only people who ever access this server do it via a local intranet
> > site
> > over the anonymous IUSR account, and people in the local admins group).
> > Thanks!
>

 

[Dave Patrick]

Nothing beats physical access control if you must leave them logged on.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"AlanN" wrote:
> Hi Dave,
>
> Thanks for the reply, but I don't think you've read my OP!
>
> I'm looking to secure the hacks below a little. Could you have another
> read
> of my suggestion and let me know your thoughts?
>
> Thanks,
>
> Alan