| 1 | <?xml version='1.0' encoding='UTF-8'?>
|
|---|
| 2 | <!DOCTYPE topic PUBLIC "-//OASIS//DTD DITA Topic//EN" "topic.dtd">
|
|---|
| 3 | <topic xml:lang="en-us" id="autologon_win">
|
|---|
| 4 | <title>Automated Windows Guest Logins</title>
|
|---|
| 5 |
|
|---|
| 6 | <body>
|
|---|
| 7 | <p>Windows provides a modular system login subsystem, called Winlogon, which can be customized and extended by means
|
|---|
| 8 | of so-called GINA (Graphical Identification and Authentication) modules. In Windows Vista and later releases, the
|
|---|
| 9 | GINA modules were replaced with a new mechanism called credential providers. The <ph
|
|---|
| 10 | conkeyref="vbox-conkeyref-phrases/product-name"/> Guest Additions for Windows come with both, a GINA and a
|
|---|
| 11 | credential provider module, and therefore enable any Windows guest to perform automated logins. </p>
|
|---|
| 12 | <p>To activate the <ph conkeyref="vbox-conkeyref-phrases/product-name"/> GINA or credential provider module, install
|
|---|
| 13 | the Guest Additions using the command line switch <codeph>/with_autologon</codeph>. All the following manual steps
|
|---|
| 14 | required for installing these modules will be then done by the installer. </p>
|
|---|
| 15 | <p>To manually install the <ph conkeyref="vbox-conkeyref-phrases/product-name"/> GINA module, extract the Guest
|
|---|
| 16 | Additions as shown in <xref href="windows-guest-file-extraction.dita">Manual File Extraction</xref>, and copy the
|
|---|
| 17 | <filepath>VBoxGINA.dll</filepath> file to the Windows <filepath>SYSTEM32</filepath> directory. In the registry,
|
|---|
| 18 | create the following key with a value of <filepath>VBoxGINA.dll</filepath>: </p>
|
|---|
| 19 | <pre xml:space="preserve">HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL</pre>
|
|---|
| 20 | <note>
|
|---|
| 21 | <p>The <ph conkeyref="vbox-conkeyref-phrases/product-name"/> GINA module is implemented as a wrapper around the
|
|---|
| 22 | <filepath>MSGINA.DLL</filepath> standard Windows GINA module. As a result, it might not work correctly with
|
|---|
| 23 | third-party GINA modules. </p>
|
|---|
| 24 | </note>
|
|---|
| 25 | <p>To manually install the <ph conkeyref="vbox-conkeyref-phrases/product-name"/> credential provider module, extract
|
|---|
| 26 | the Guest Additions as shown in <xref href="windows-guest-file-extraction.dita">Manual File Extraction</xref> and
|
|---|
| 27 | copy the <filepath>VBoxCredProv.dll</filepath> file to the Windows <filepath>SYSTEM32</filepath> directory. In the
|
|---|
| 28 | registry, create the following keys: </p>
|
|---|
| 29 | <pre xml:space="preserve">HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
|
|---|
| 30 | Authentication\Credential Providers\{275D3BCC-22BB-4948-A7F6-3A3054EBA92B}
|
|---|
| 31 |
|
|---|
| 32 | HKEY_CLASSES_ROOT\CLSID\{275D3BCC-22BB-4948-A7F6-3A3054EBA92B}
|
|---|
| 33 |
|
|---|
| 34 | HKEY_CLASSES_ROOT\CLSID\{275D3BCC-22BB-4948-A7F6-3A3054EBA92B}\InprocServer32</pre>
|
|---|
| 35 | <p>All default values, the key named <codeph>Default</codeph>, must be set to <codeph>VBoxCredProv</codeph>. </p>
|
|---|
| 36 | <p>Create the following string and assign it a value of <codeph>Apartment</codeph>. </p>
|
|---|
| 37 | <pre xml:space="preserve">HKEY_CLASSES_ROOT\CLSID\{275D3BCC-22BB-4948-A7F6-3A3054EBA92B}\InprocServer32\ThreadingModel</pre>
|
|---|
| 38 | <p>
|
|---|
| 39 | To set credentials, use the following command on a
|
|---|
| 40 | <i>running</i> VM:
|
|---|
| 41 | </p>
|
|---|
| 42 | <pre xml:space="preserve">$ VBoxManage controlvm "Windows XP" setcredentials "John Doe" "secretpassword" "DOMTEST"</pre>
|
|---|
| 43 | <p>While the VM is running, the credentials can be queried by the <ph
|
|---|
| 44 | conkeyref="vbox-conkeyref-phrases/product-name"/> login modules, GINA or credential provider, using the <ph
|
|---|
| 45 | conkeyref="vbox-conkeyref-phrases/product-name"/> Guest Additions device driver. When Windows is in <i>logged
|
|---|
| 46 | out</i> mode, the login modules will constantly poll for credentials and if they are present, a login will be
|
|---|
| 47 | attempted. After retrieving the credentials, the login modules will erase them so that the above command will have
|
|---|
| 48 | to be repeated for subsequent logins. </p>
|
|---|
| 49 | <p>For security reasons, credentials are not stored in any persistent manner and will be lost when the VM is reset.
|
|---|
| 50 | Also, the credentials are write-only. There is no way to retrieve the credentials from the host side. Credentials
|
|---|
| 51 | can be reset from the host side by setting empty values. </p>
|
|---|
| 52 | <p>Depending on the Windows guest version, the following restrictions apply: </p>
|
|---|
| 53 | <ul>
|
|---|
| 54 | <li>
|
|---|
| 55 | <p>For <b outputclass="bold">Windows XP guests.</b> The login subsystem needs to be configured to use the
|
|---|
| 56 | classic login dialog, as the <ph conkeyref="vbox-conkeyref-phrases/product-name"/> GINA module does not
|
|---|
| 57 | support the Windows XP-style welcome dialog. </p>
|
|---|
| 58 | </li>
|
|---|
| 59 | <li>
|
|---|
| 60 | <p><b outputclass="bold">Windows Vista, Windows 7, Windows 8, Windows 10 and Windows 11 guests.</b> The login subsystem does not support the so-called Secure Attention Sequence, <codeph>Ctrl+Alt+Del</codeph>. As a result, the guest's group policy settings need to be changed to not use the Secure Attention Sequence. Also, the user name given is only compared to the true user name, not the user friendly name. This means that when you rename a user, you still have to supply the original user name as Windows never renames user accounts internally. </p>
|
|---|
| 61 | </li>
|
|---|
| 62 | <li>
|
|---|
| 63 | <p>Automatic login handling of the built-in <b outputclass="bold">Windows Remote Desktop Service</b>, formerly
|
|---|
| 64 | known as Terminal Services, is disabled by default. To enable it, create the following registry key with a
|
|---|
| 65 | <codeph>DWORD</codeph> value of <codeph>1</codeph>. </p>
|
|---|
| 66 | <pre xml:space="preserve">HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions\AutoLogon</pre>
|
|---|
| 67 | </li>
|
|---|
| 68 | </ul>
|
|---|
| 69 | <p>The following command forces <ph conkeyref="vbox-conkeyref-phrases/product-name"/> to keep the credentials after
|
|---|
| 70 | they were read by the guest and on VM reset: </p>
|
|---|
| 71 | <pre xml:space="preserve">$ VBoxManage setextradata "Windows XP" VBoxInternal/Devices/VMMDev/0/Config/KeepCredentials 1</pre>
|
|---|
| 72 | <p>Note that this is a potential security risk, as a malicious application running on the guest could request this
|
|---|
| 73 | information using the proper interface. </p>
|
|---|
| 74 | </body>
|
|---|
| 75 |
|
|---|
| 76 | </topic>
|
|---|
