When working with public kiosks or shared workstations in enterprise environments, we often need automatic logon functionality. The familiar control userpasswords2 method disappears after domain joining, creating a security and convenience dilemma.

The most reliable method involves modifying the Windows Registry. Create a PowerShell script with the following parameters:

# Set AutoAdminLogon and Default credentials
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "AutoAdminLogon" -Value "1" -Type String
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "DefaultDomainName" -Value "YOURDOMAIN" -Type String
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "DefaultUserName" -Value "serviceaccount" -Type String
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "DefaultPassword" -Value "P@ssw0rd123" -Type String

Never store plaintext passwords in production. Instead:

1. Create a dedicated domain account with minimal privileges
2. Set password to never expire
3. Restrict logon hours if possible
4. Encrypt the registry values using LSA protection

For enterprise deployments, consider these GPO settings:

Computer Configuration > Administrative Templates > System > Logon
- Configure automatic logon = Enabled
- Do not display username at logon = Enabled

Here's a complete deployment script that handles encryption:

# Encrypt and store password securely
$secureString = ConvertTo-SecureString "YourPassword" -AsPlainText -Force
$encrypted = ConvertFrom-SecureString -SecureString $secureString
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "AutoAdminLogon" -Value "1"
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "DefaultPassword" -Value $encrypted

• Verify the account has "Allow log on locally" rights
• Check Event Viewer for logon failure events
• Test with local account first before domain account
• Disable UAC prompts for the service account

When working with standalone Windows machines, enabling auto-logon is straightforward through control userpasswords2 or the netplwiz utility. However, these GUI options disappear after domain join due to security policies. Here's how to implement this securely in an enterprise environment.

For individual machines, modify these registry keys (create if they don't exist):

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"DefaultUserName"="DOMAIN\\username"
"DefaultPassword"="P@ssw0rd123"
"DefaultDomainName"="YOURDOMAIN"
"AutoAdminLogon"="1"
"ForceAutoLogon"="1"

For domain-wide deployment, create a GPO with these settings:

<GroupPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <ComputerConfiguration>
    <Preferences>
      <RegistrySettings>
        <Registry clsid="{...}" name="AutoAdminLogon" status="1">
          <Properties action="U" displayDecimal="" default="0" hive="HKEY_LOCAL_MACHINE" key="SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" name="AutoAdminLogon" type="REG_SZ" value="1"/>
        </Registry>
      </RegistrySettings>
    </Preferences>
  </ComputerConfiguration>
</GroupPolicy>

Important security measures when implementing auto-logon:

• Use dedicated service accounts with minimal privileges
• Enable LSA protection (RunAsPPL) to prevent credential theft
• Set account to auto-lock after business hours
• Regularly rotate credentials using scheduled tasks

PowerShell script to update credentials securely:

# Requires -RunAsAdministrator
$newPassword = ConvertTo-SecureString -String (New-Guid).Guid -AsPlainText -Force
Set-ADAccountPassword -Identity "kiosk_user" -NewPassword $newPassword
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "DefaultPassword" -Value ([System.Runtime.InteropServices.Marshal]::PtrToStringAuto([System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($newPassword)))
Restart-Computer -Force

If auto-logon fails:

1. Verify the account has "Allow log on locally" rights
2. Check for conflicting screen saver policies
3. Ensure no GPOs are resetting your registry changes
4. Confirm the machine can reach the domain controller