Automatic sign-in keeps a password in the registry
What this means
Windows signs in by itself using a password stored in plain text in the registry (Winlogon's DefaultPassword). Anyone with administrator access, any malware running as administrator, and anyone with the disk can read that account's password.
How to fix it
Turn off automatic sign-in (run netplwiz and tick Users must enter a user name and password, or set AutoAdminLogon to 0), then delete the DefaultPassword value under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon and change that account's password.
Check it yourself
Run a scan and look for BLWK-WIN-009 in the results:
bulwark scanInstalled the standalone CLI package instead of the app? The command is bulwarkctl.
How Bulwark decides
Bulwark reads windows_security and reports this check when:
autologon_password_stored_known == true and autologon_password_stored == trueIf a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.
References
Related checks
- Cron entry runs a downloader piped to a shell ·
BLWK-ACCT-001 - Password maximum age is excessively long ·
BLWK-ACCT-002 - Password minimum age is zero ·
BLWK-ACCT-003 - Password hashing rounds are not explicitly configured ·
BLWK-ACCT-004 - Default UMASK is not explicitly configured ·
BLWK-ACCT-005 - A sensitive system file is world-writable ·
BLWK-FS-001