in General

Boot up Windows before you even log in

If you don’t use any Windows XP login security, then you can skip this article. Otherwise, if you are like many Windows XP users who have to enter a password every time their computer sluggishly boots up, then read this!

Ok. Here’s the scenario:

You have to wait 2 minutes while your computer turns on. You have to sit in front of your computer during this whole time because once it finally gets to the login screen, you have to type in the password. The computer then crunches numbers for another 2 minutes while it loads a wide variety of programs (MSN messenger, your Norton Antivirus, your Microsoft Office shortcut bar, etc…). Finally, after like 5 minutes, you have access to your desktop.

How would you like your computer to load all those programs *before* you ever have to enter your password? You could press the button to power up your system and go get a cup of coffee. Five minutes later, you come to your desk and type in your password. BAM! Instantly dropped to the desktop! Your programs are already running and all systems are a go!

Here’s how to do it:

  1. Download Microsoft’s free TweakUI tool and install it.
  2. Click your Start button, go to your Programs menu, and select Tweak UI from the “Powertoys for Windows XP” folder.
  3. In the TweakUI window, double-click the “Logon” item in the left-hand column to expand it.
  4. Click on the “Autologon” item underneath the “Logon” section.
  5. Check the box that says “Log on automatically at system startup”
  6. Click the “Set Password” button and enter in your windows login password
  7. Click OK and close Tweak UI.
  8. Download this .reg file and run it. When it asks you if you want to merge it with your registry, choose “Yes”.

    NOTE: If you feel queasy about merging a reg file with your registry, you can also add it by hand. Go to Start > Run and type in “regedit” and press OK. Browse to [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] and create a new String Value. Name it “Lock Computer on Startup“, and set the value to “rundll32.exe user32.dll, LockWorkStation

Presto! You’re done!

Now, when you boot up your computer, it will automatically log you in to your desktop and start up your programs. However, it will still secure your system, requiring you to enter your password to access it.

38 Comments

  1. “Not really a secure solution. Your password will be in cleartex stored in the registry.”

    Well, at least TweakUI says different:
    “The password is stored in encrypted form”

    Thx for the tip, saves a lotta time for me;)

  2. Why must there always be nay-sayers to everything?

    Un-informed Statement #1: “Tweak UI saves your login in clear text. This is a horrible security risk!”

    Reply: Uh. Have you actually done any research on this claim or are you going off of paranoid rumors? Try opening up Tweak UI and go to the autologon section. There is is, plain as day, “The password is stored in encrypted form”.

    Un-informed Statement #2: “This is so insecure! All anyone has to do is hold down their Shift key while they’re logging in and it will bypass the automatic lock.”

    Reply: Once again. Has anyone actually tried this? Sure, the Shift key, when held, will skip automatic start-up processes. But here’s the beauty of it… If you hold down the Shift key, it doesn’t process your automatic login. So you’re still stuck behind a password box. Verdict: still safe!

    Un-informed Statement #3: “While your desktop is loading before the computer locks itself back up, users can click around and get around your security.”

    Reply: This may be the case on some computers out there, but my experience with Windows is that while it’s loading the desktop, everything is pretty much completely un-responsive. I try to click the start menu and nothing even happens until everything is loaded and cached up into memory. And the second the computer is loaded and finally becomes responsive… it’s instantly locked. Foiled, once again. Now, this is just my experience that I’ve had with the 10 or so computers that I’ve used this technique with, so I could be wrong. If your computer is responsive while loading your desktop and you are able to click around for a minute or so before it locks, then yeah. Maybe you shouldn’t use this tweak.

    Un-informed Statement #4: “Man, this tweak is so stupid! It doesn’t make my computer go any faster! It still takes 5 minutes to load!”

    Reply: This tweak isn’t supposed to make your computer boot “faster”, per se. All it does is change that point at which you have to log in. Instead of having the login point half-way during the boot process (requiring you to sit in front of the computer during the whole process), now it’s at the very end after everything is finally loaded. Some people (such as myself) will find this extremely useful. Other people, maybe not so much.

    Let me give you an example of one of the ways why I find this tweak useful on my computer at home. My computer at home has a number of programs that run when it boots up. I run a total of 5 different servers on my computer… Apache, Microsoft IIS, my custom home security system, etc… These programs and servers run 24 hours a day. If my computer ever bogs down and crashes for some reason, it automatically reboots. When it re-boots, it automatically logs itself in and locks down.

  3. how do i remove the reg file now that it has merged with my registry?

  4. Dream mode on :
    I boot, the boot process asks me for a login/password, and it passes them to the OS.

    Dream mode off.

  5. how do i remove the reg file now that it has merged with my registry? TIA

  6. Just browse to the key in your registry and remove it. The key is at:
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

  7. Nice job, Tom!
    This is so cool, maybe I won’t let you beat at COD2 next time.

    Joey (aka “BigMamma”, aka “LiquidG”, aka “unknown soldier”)

  8. Nice one Thomas!

    First of all an answer:
    Q :”Is this registry Tweak possible for Win 2000?”

    A :Definitely YES. I use Win2K and I use this command in a batch file.Running it from the registry is the same.
    ———–

    And to back-up Thomas:
    Misunderstanding :“Your password will be in cleartex stored in the registry”

    My opinion : Not the case.Win2K and WinXP have the autologon feature.If you go to Control Panel under Users there is an option to enable it.If you enable it,it asks for the name and password of the user you want to autologon.
    TweakUI just enables this option and passes the name and password to Windows.Windows then encrypts the password.
    So your password encryption is just as strong as Windows’ is.
    I don’t consider this a “horrible security risk”.
    Don’t take my word for it!Try a search in the registry with your password, try a file search for files containing your password…You shouldn’t find a thing.I didn’t.

    Keep up the good work!
    ZaC

  9. I just read all the above comments going back and forth about plaintext passwords in the registry.

    Rather than debate this, I’ll refer you to a Microsoft Technet article that comments on this feature and then show where in the registry that this setting is stored in plaintext.

    http://support.microsoft.com/default.aspx?scid=kb;en-us;234562

    Location of plaintext password:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassword

    What is even worse is that the system restore feature of windows makes copies of the registry hives on a regular basis. So adding it all up, if you now decide to turn off this option, your password is still in plain text on the hard drive.

    Sincerly,
    Chad Woznick
    http://www.nearlyclever.com

  10. Hello Chad,

    Thank you for your security concerns.

    However, one thing you may not be aware of is the fact that the insecure “auto-login” method on Technet is actually unrelated to the method used by TweakUI and my article.

    The latest version of TweakUI for Windows XP does *not* store your password in the registry in plaintext.

    I encourage you to download Regmon from sysinternals. It is a free utility that will let you monitor your windows registry as programs manipulate it. Turn on TweakUI and go to the auto-login feature. Open up the “Set Password” box, type in a password, and save it with the registry monitor recording everything. You won’t find a clear-text password anywhere.

  11. Thomas,

    Sorry about the previous post. I followed up and verified what you mentioned above regarding Tweakui storing the password in a “more” secure method. It’s funny that you mention regmon, because that is the tool I used to check out what the new version of tweakui is doing.

    However, my recommendation still stands that this is an insecure method for domain logons based on what I found out about Tweakui’s new method.

    Tweakui calls the local windows security service and the local windows security service stores the password in an area of the registry that is not normal accessible, even from the admin account. 😉 Being curious, I elevated a cmd.exe window to system status, and ran regedit as the system account.

    The security service stores a hash at the following location: [HKEY_LOCAL_MACHINE \ SECURITY \ Policy \ Secrets \ DefaultPassword \ CurrVal]

    I’ve only played around with it for a little bit, but it looks like the method Microsoft is using to store the password is reversable. That is, everytime Tweakui is used to modify this value, it produces the same result. It doesn’t look like it changes on use.

    So, based on this, and the easy way to bypass the lock feature with task manager (I re-tested that), this quick way to logon does not seem secure.

    Once again, I am sorry for referring to the old way TweakUI worked in the earlier posts.

    Respectfully,
    Chad Woznick
    http://www.nearlyclever.com

  12. So basically… the tweak ui password is encrypted in a hidden area of your registry that is technically just as secure as the place that your windows password itself is located.

    The only thing you have to worry about, then, is someone bypassing the automatic lock when the computer boots up through some sort of hack.

    I will not deny that this is a possibility. However, I *did* try, and wasn’t able to replicate the technique that you mentioned.

    So in conclusion, people, if you work in a high-risk environment and your co-workers are all highly knowledgable computer administrators and/or hackers, I recommend that you don’t use this time saving auto-login trick.

    However, for the average computer user in a low to medium security environment, I think you will still find this auto-login and lock trick to be useful.

Comments are closed.

Webmentions

  • Minimizr » Blog Archive » Boot Up Windows Before You Even Log In January 24, 2006

    […] If you wait couple minutes after turning your computer on to log in Windows and after log in you wait still some more minutes before Windows is ready to go, this tip is for you and it will save you minutes every day. After booting up to login screen Windows will login automatically and lock the desktop right after that. So, you boot up your computer and next you unlock the desktop and can start surfing the web right away. Note that for security reasons this really probably suitable only for home computer with singel user. […]

  • Techies blog January 24, 2006

    Windows indítás belépés előtt…

    Hogyan lehet úgy elindítani a Windowst, hogy a belépés után már ne kelljen megvárni a saját programok indítását? Ez szerintem egy nagyon izgalmas kérdés. Tipikus…