| 1 | <?xml version='1.0' encoding='UTF-8'?>
|
|---|
| 2 | <!DOCTYPE topic PUBLIC "-//OASIS//DTD DITA Topic//EN" "topic.dtd">
|
|---|
| 3 | <topic xml:lang="en-us" id="autologon_win">
|
|---|
| 4 | <title>Automated Windows Guest Logins</title>
|
|---|
| 5 |
|
|---|
| 6 | <body>
|
|---|
| 7 | <p>Windows provides a modular system login subsystem, called Winlogon, which can be customized and extended by means
|
|---|
| 8 | of so-called GINA (Graphical Identification and Authentication) modules. In Windows Vista and later releases, the
|
|---|
| 9 | GINA modules were replaced with a new mechanism called credential providers. The <ph
|
|---|
| 10 | conkeyref="vbox-conkeyref-phrases/product-name"/> Guest Additions for Windows come with both, a GINA and a
|
|---|
| 11 | credential provider module, and therefore enable any Windows guest to perform automated logins. </p>
|
|---|
| 12 | <p>To activate the <ph conkeyref="vbox-conkeyref-phrases/product-name"/> GINA or credential provider module, install
|
|---|
| 13 | the Guest Additions using the command line switch <codeph>/with_autologon</codeph>. All the following manual steps
|
|---|
| 14 | required for installing these modules will be then done by the installer. </p>
|
|---|
| 15 | <p>To manually install the <ph conkeyref="vbox-conkeyref-phrases/product-name"/> GINA module, extract the Guest
|
|---|
| 16 | Additions as shown in <xref href="windows-guest-file-extraction.dita">Manual File Extraction</xref>, and copy the
|
|---|
| 17 | <filepath>VBoxGINA.dll</filepath> file to the Windows <filepath>SYSTEM32</filepath> directory. In the registry,
|
|---|
| 18 | create the following key with a value of <filepath>VBoxGINA.dll</filepath>: </p>
|
|---|
| 19 | <pre xml:space="preserve">HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL</pre>
|
|---|
| 20 | <note>
|
|---|
| 21 | <p>The <ph conkeyref="vbox-conkeyref-phrases/product-name"/> GINA module is implemented as a wrapper around the
|
|---|
| 22 | <filepath>MSGINA.DLL</filepath> standard Windows GINA module. As a result, it might not work correctly with
|
|---|
| 23 | third-party GINA modules. </p>
|
|---|
| 24 | </note>
|
|---|
| 25 | <p>To manually install the <ph conkeyref="vbox-conkeyref-phrases/product-name"/> credential provider module, extract
|
|---|
| 26 | the Guest Additions as shown in <xref href="windows-guest-file-extraction.dita">Manual File Extraction</xref> and
|
|---|
| 27 | copy the <filepath>VBoxCredProv.dll</filepath> file to the Windows <filepath>SYSTEM32</filepath> directory. In the
|
|---|
| 28 | registry, create the following keys: </p>
|
|---|
| 29 | <pre xml:space="preserve">HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
|
|---|
| 30 | Authentication\Credential Providers\{275D3BCC-22BB-4948-A7F6-3A3054EBA92B}
|
|---|
| 31 |
|
|---|
| 32 | HKEY_CLASSES_ROOT\CLSID\{275D3BCC-22BB-4948-A7F6-3A3054EBA92B}
|
|---|
| 33 |
|
|---|
| 34 | HKEY_CLASSES_ROOT\CLSID\{275D3BCC-22BB-4948-A7F6-3A3054EBA92B}\InprocServer32</pre>
|
|---|
| 35 | <p>All default values, the key named <codeph>Default</codeph>, must be set to <codeph>VBoxCredProv</codeph>. </p>
|
|---|
| 36 | <p>Create the following string and assign it a value of <codeph>Apartment</codeph>. </p>
|
|---|
| 37 | <pre xml:space="preserve">HKEY_CLASSES_ROOT\CLSID\{275D3BCC-22BB-4948-A7F6-3A3054EBA92B}\InprocServer32\ThreadingModel</pre>
|
|---|
| 38 | <p>
|
|---|
| 39 | To set credentials, use the following command on a
|
|---|
| 40 | <i>running</i> VM:
|
|---|
| 41 | </p>
|
|---|
| 42 | <pre xml:space="preserve">$ VBoxManage controlvm "Windows XP" setcredentials "John Doe" "secretpassword" "DOMTEST"</pre>
|
|---|
| 43 | <p>While the VM is running, the credentials can be queried by the <ph
|
|---|
| 44 | conkeyref="vbox-conkeyref-phrases/product-name"/> login modules, GINA or credential provider, using the <ph
|
|---|
| 45 | conkeyref="vbox-conkeyref-phrases/product-name"/> Guest Additions device driver. When Windows is in <i>logged
|
|---|
| 46 | out</i> mode, the login modules will constantly poll for credentials and if they are present, a login will be
|
|---|
| 47 | attempted. After retrieving the credentials, the login modules will erase them so that the above command will have
|
|---|
| 48 | to be repeated for subsequent logins. </p>
|
|---|
| 49 | <p>For security reasons, credentials are not stored in any persistent manner and will be lost when the VM is reset.
|
|---|
| 50 | Also, the credentials are write-only. There is no way to retrieve the credentials from the host side. Credentials
|
|---|
| 51 | can be reset from the host side by setting empty values. </p>
|
|---|
| 52 | <p>Depending on the Windows guest version, the following restrictions apply: </p>
|
|---|
| 53 | <ul>
|
|---|
| 54 | <li>
|
|---|
| 55 | <p>For <b outputclass="bold">Windows XP guests.</b> The login subsystem needs to be configured to use the
|
|---|
| 56 | classic login dialog, as the <ph conkeyref="vbox-conkeyref-phrases/product-name"/> GINA module does not
|
|---|
| 57 | support the Windows XP-style welcome dialog. </p>
|
|---|
| 58 | </li>
|
|---|
| 59 | <li>
|
|---|
| 60 | <p><b outputclass="bold">Windows Vista, Windows 7, Windows 8,
|
|---|
| 61 | and Windows 10 guests.</b> The login subsystem does
|
|---|
| 62 | not support the so-called Secure Attention Sequence,
|
|---|
| 63 | <codeph>Ctrl+Alt+Del</codeph>. As a result, the guest's
|
|---|
| 64 | group policy settings need to be changed to not use the
|
|---|
| 65 | Secure Attention Sequence. Also, the user name given is only
|
|---|
| 66 | compared to the true user name, not the user friendly name.
|
|---|
| 67 | This means that when you rename a user, you still have to
|
|---|
| 68 | supply the original user name as Windows never renames user
|
|---|
| 69 | accounts internally.
|
|---|
| 70 | </p>
|
|---|
| 71 | </li>
|
|---|
| 72 | <li>
|
|---|
| 73 | <p>Automatic login handling of the built-in <b outputclass="bold">Windows Remote Desktop Service</b>, formerly
|
|---|
| 74 | known as Terminal Services, is disabled by default. To enable it, create the following registry key with a
|
|---|
| 75 | <codeph>DWORD</codeph> value of <codeph>1</codeph>. </p>
|
|---|
| 76 | <pre xml:space="preserve">HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions\AutoLogon</pre>
|
|---|
| 77 | </li>
|
|---|
| 78 | </ul>
|
|---|
| 79 | <p>The following command forces <ph conkeyref="vbox-conkeyref-phrases/product-name"/> to keep the credentials after
|
|---|
| 80 | they were read by the guest and on VM reset: </p>
|
|---|
| 81 | <pre xml:space="preserve">$ VBoxManage setextradata "Windows XP" VBoxInternal/Devices/VMMDev/0/Config/KeepCredentials 1</pre>
|
|---|
| 82 | <p>Note that this is a potential security risk, as a malicious application running on the guest could request this
|
|---|
| 83 | information using the proper interface. </p>
|
|---|
| 84 | </body>
|
|---|
| 85 |
|
|---|
| 86 | </topic>
|
|---|
