Enhancing Security with PowerShell: Disabling Automatic Login and Enforcing CTRL+ALT+DELETE 

In IT environments, security is paramount, and every layer of defense matters. One often-overlooked security measure is requiring users to press CTRL+ALT+DELETE before logging in. This action acts as a secure attention sequence (SAS), ensuring that the login screen is authentic and not a spoofed interface created by malware.

For IT professionals and managed service providers (MSPs), automating such tasks can save time and enforce consistency. The provided PowerShell script does precisely that: it disables automatic login and enforces the CTRL+ALT+DELETE requirement on Windows systems.

Understanding the Need for Secure Login Practices

The CTRL+ALT+DELETE requirement isn’t just a user inconvenience—it provides critical security benefits. This combination ensures users interact with the operating system’s secure authentication subsystem rather than potentially malicious programs. Additionally, disabling automatic login prevents unauthorized access in shared or sensitive environments. IT professionals managing fleets of devices can find this script invaluable for quickly implementing these settings across systems.

The Script:

#Requires -Version 5.1

<#
.SYNOPSIS
    Disables the automatic login feature and requires 'CTRL', 'ALT', and 'DELETE' to be pressed each time a user signs in. Once 'Interactive logon: Do not require CTRL+ALT+DEL' is apart of the security policy it cannot be removed from the policy. It either has to be enabled or disabled.
.DESCRIPTION
    Disables the automatic login feature and requires 'CTRL', 'ALT', and 'DELETE' to be pressed each time a user signs in. Once 'Interactive logon: Do not require CTRL+ALT+DEL' is apart of the security policy it cannot be removed from the policy. It either has to be enabled or disabled.

    By using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https://www.ninjaone.com/terms-of-use.
    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. 
    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. 
    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. 
    Warranty Disclaimer: The script is provided “as is” and “as available”, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. 
    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. 
    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. 
    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).
.EXAMPLE
    (No Parameters)
    
    Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon changed from 1 to 0
    Retrieving existing security policy...
                                                                            
    The task has completed successfully.
    See log %windir%\security\logs\scesrv.log for detail info.
    Modifying policy to require Ctrl Alt Del to be pressed on login.
    Applying updated policy...
    Completed 5 percent (0/18) 	Process Security Policy area        
    Completed 22 percent (3/18) 	Process Security Policy area        
    Completed 44 percent (7/18) 	Process Security Policy area        
    Completed 61 percent (10/18) 	Process Security Policy area        
    Completed 77 percent (13/18) 	Process Security Policy area        
    Completed 100 percent (18/18) 	Process Security Policy area        
                                                                            
    The task has completed successfully.
    See log %windir%\security\logs\scesrv.log for detail info.

PARAMETER: -MicrosoftDefaults
    Reverts all the modified settings to their Microsoft default value.

PARAMETER: -ForceRestart
    Schedules a restart for 60 seconds from now so that the CTRL+ALT+DEL login requirement may take immediate effect.

.NOTES
    Minimum OS Architecture Supported: Windows 10, Windows Server 2016
    Release Notes: Initial Release
#>

[CmdletBinding()]
param (
    [Parameter()]
    [Switch]$MicrosoftDefaults = [System.Convert]::ToBoolean($env:revertToMicrosoftDefaults),
    [Parameter()]
    [Switch]$ForceRestart = [System.Convert]::ToBoolean($env:forceRestart)
)

begin {

    function Test-IsDomainJoined {
        if ($PSVersionTable.PSVersion.Major -lt 5) {
            return $(Get-WmiObject -Class Win32_ComputerSystem).PartOfDomain
        }
        else {
            return $(Get-CimInstance -Class Win32_ComputerSystem).PartOfDomain
        }
    }

    function Set-RegKey {
        param (
            $Path,
            $Name,
            $Value,
            [ValidateSet("DWord", "QWord", "String", "ExpandedString", "Binary", "MultiString", "Unknown")]
            $PropertyType = "DWord"
        )

        # Check if the specified path exists, if not, create it.
        if (-not $(Test-Path -Path $Path)) {
            New-Item -Path $Path -Force | Out-Null
        }

        # Check if the property already exists at the path.
        if ((Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue)) {

            # Retrieve the current value of the registry key.
            $CurrentValue = (Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue).$Name
            try {
                # Attempt to update the property's value.
                Set-ItemProperty -Path $Path -Name $Name -Value $Value -Force -Confirm:$false -ErrorAction Stop | Out-Null
            }
            catch {
                # If an error occurs during the update, print an error message and exit.
                Write-Host "[Error] Unable to Set registry key for $Name please see below error!"
                Write-Host "[Error] $($_.Message)"
                exit 1
            }
            # Print a confirmation of the change.
            Write-Host "$Path\$Name changed from $CurrentValue to $($(Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue).$Name)"
        }
        else {
            try {
                # If the property does not exist, create it with the specified value and type.
                New-ItemProperty -Path $Path -Name $Name -Value $Value -PropertyType $PropertyType -Force -Confirm:$false -ErrorAction Stop | Out-Null
            }
            catch {
                # If an error occurs during creation, print an error message and exit.
                Write-Host "[Error] Unable to Set registry key for $Name please see below error!"
                Write-Host "[Error] $($_.Exception.Message)"
                exit 1
            }

            # Print a confirmation of the change.
            Write-Host "Set $Path\$Name to $($(Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue).$Name)"
        }
    }
    function Test-IsElevated {
        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()
        $p = New-Object System.Security.Principal.WindowsPrincipal($id)
        $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)
    }

    if (!$ExitCode) {
        $ExitCode = 0
    }
}
process {
    # Check if the current user session is elevated with administrator privileges. If not, display an error message and exit the script.
    if (!(Test-IsElevated)) {
        Write-Host -Object "[Error] Access Denied. Please run with Administrator privileges."
        exit 1
    }

    # Retrieve the AutoAdminLogon and DefaultPassword registry values to check for automatic login settings and stored passwords.
    $AutoLogin = Get-ItemProperty -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "AutoAdminLogon" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty "AutoAdminLogon" -ErrorAction SilentlyContinue
    $DefaultPassword = Get-ItemProperty -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "DefaultPassword" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty "DefaultPassword" -ErrorAction SilentlyContinue
    $PasswordLessSetting = Get-ItemProperty -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" -Name "DevicePasswordLessBuildVersion" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty "DevicePasswordLessBuildVersion" -ErrorAction SilentlyContinue

    # Alert if a password is stored in the registry, which might be insecure if in plain text.
    if ($DefaultPassword) {
        Write-Host "[Alert] A Password is stored in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassword. This password is likely in plain text."
    }

    # Check if the device is part of a domain, and if so, recommend using group policy for login settings.
    if (Test-IsDomainJoined) {
        Write-Host "[Error] This device is domain joined. CTRL ALT Delete login should be setup using group policy."
        Write-Host "[Info] Group Policy Location: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Interactive logon:(...)"
        Write-Host "[Info] https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del"
        exit 1
    }

    # Turn off automatic login if it is enabled.
    if ($AutoLogin -ne 0) {
        Set-RegKey -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "AutoAdminLogon" -Value 0
    }

    # Disable automatic login if it is enabled
    if ($PasswordLessSetting -eq 0) {
        Set-RegKey -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" -Name "DevicePasswordLessBuildVersion" -Value 2
    }

    # Announce the start of the security policy retrieval process.
    Write-Host "Retrieving existing security policy..."

    # Export the current security policy and record the output to a temporary file.
    $SecurityPolicyPath = "$env:TEMP\enable-ctrlaltdellogin.cfg"
    $OutputPath = "$env:TEMP\enable-ctrlaltdellogin.txt"
    $ExportPolicy = Start-Process SecEdit.exe -ArgumentList "/export /cfg $SecurityPolicyPath" -RedirectStandardOutput $OutputPath -NoNewWindow -Wait -PassThru
    $ExportPolicyOutput = Get-Content -Path $OutputPath

    # Display the output of the policy export and clean up the temporary file.
    if ($ExportPolicyOutput) {
        $ExportPolicyOutput | Write-Host
        Remove-Item $OutputPath
    }

    # Check the exit code of the export process and display an error message if the export failed.
    if ($ExportPolicy.ExitCode -ne 0) {
        Write-Host -Object "Exit Code: $($ExportPolicy.ExitCode)"
        Write-Host -Object "[Error] Unable to edit security policy."
        exit 1
    }
    
    # Check if Microsoft default setting is specifed.
    if ($MicrosoftDefaults) {
        Write-Host "Removing Ctrl Alt Del requirement from security policy..."

        # Initialize a new list to store modified security policy settings.
        $NewSecPolicy = New-Object System.Collections.Generic.List[string]

        # Read the current security policy and process each line.
        Get-Content $SecurityPolicyPath | ForEach-Object {

            # If the line contains settings for CTRL ALT DEL, reset the value.
            if ($_ -match "DisableCAD") {
                $NewSecPolicy.Add(($_ -replace ",.*", ",1"))
            }
            else {
                $NewSecPolicy.Add($_)
            }
        }

        # Write the modified security policy back to the configuration file.
        $NewSecPolicy | Out-File $SecurityPolicyPath

        Write-Host "Applying updated policy..."
        # Apply the modified security policy using SecEdit.exe.
        $UpdateSecurityPolicy = Start-Process SecEdit.exe -ArgumentList "/configure /db c:\windows\security\local.sdb /cfg $SecurityPolicyPath" -RedirectStandardOutput $OutputPath -Wait -NoNewWindow -PassThru
    
        # Capture the output from the policy update and display it.
        $UpdatePolicyOutput = Get-Content -Path $OutputPath
        if ($UpdatePolicyOutput) {
            $UpdatePolicyOutput | Write-Host
            Remove-Item $OutputPath
        }
    

        # Check the exit code of the policy update process and handle errors.
        if ($UpdateSecurityPolicy.ExitCode -ne 0) {
            Write-Host -Object "Exit Code: $($UpdateSecurityPolicy.ExitCode)"
            Write-Host -Object "[Error] Unable to update security policy."
            exit 1
        }
        else {
            if ($ForceRestart) {
                Write-Warning -Message "Scheduling system restart for 60 seconds from now. $((Get-Date).AddMinutes(60))"
                Start-Process shutdown.exe -ArgumentList "/r /t 60" -Wait -NoNewWindow
            }
            else {
                Write-Warning -Message "A restart may be required for the Ctrl Alt Del requirement to be removed. Please restart at your earliest convenience."
            }
            
            exit $ExitCode
        }
    }

    # Begin modification to require ctrl alt del in the security policy.
    Write-Host "Modifying policy to require Ctrl Alt Del to be pressed on login."

    # Check if the current policy already includes a ctrl alt del requirement.
    if (Get-Content $SecurityPolicyPath | Where-Object { $_ -like "*DisableCAD*" }) {
        # Replace the existing title with a new one, maintaining other parts of the line.
        $Caption = (Get-Content $SecurityPolicyPath | Where-Object { $_ -like "*DisableCAD*" }) -replace ',.*', ",0"
        (Get-Content $SecurityPolicyPath) -replace ".*DisableCAD.*", "$Caption" | Out-File $SecurityPolicyPath
    }
    else {
        # If setting is not present, create a new list for the modified policy settings.
        $NewSecPolicy = New-Object System.Collections.Generic.List[string]
        # Create the new setting.
        $Caption = "MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCAD=4,0"

        # Read the current policy and add the new setting where appropriate.
        Get-Content $SecurityPolicyPath | ForEach-Object {
            if ($_ -match "\[Registry Values\]") {
                $NewSecPolicy.Add($_)
                $NewSecPolicy.Add($Caption)
            }
            else {
                $NewSecPolicy.Add($_)
            }
        }

        # Write the modified settings back to the configuration file.
        $NewSecPolicy | Out-File $SecurityPolicyPath
    }

    # Display a message indicating that the updated security policy is being applied.
    Write-Host "Applying updated policy..."
    $UpdateSecurityPolicy = Start-Process SecEdit.exe -ArgumentList "/configure /db c:\windows\security\local.sdb /cfg $SecurityPolicyPath /areas securitypolicy" -RedirectStandardOutput $OutputPath -Wait -NoNewWindow -PassThru
    
    $UpdatePolicyOutput = Get-Content -Path $OutputPath
    # If there is any output from the SecEdit process, display it in the console.
    if ($UpdatePolicyOutput) {
        $UpdatePolicyOutput | Write-Host
        Remove-Item $OutputPath
    }
    

    # Check if the SecEdit process completed successfully by examining the exit code.
    if ($UpdateSecurityPolicy.ExitCode -ne 0) {
        Write-Host -Object "Exit Code: $($UpdateSecurityPolicy.ExitCode)"
        Write-Host -Object "[Error] Unable to update security policy."
        exit 1
    }

    if ($ForceRestart) {
        Write-Warning -Message "Scheduling system restart for 60 seconds from now. $((Get-Date).AddMinutes(60))"
        Start-Process shutdown.exe -ArgumentList "/r /t 60" -Wait -NoNewWindow
    }
    else {
        Write-Warning -Message "A restart may be required for the Ctrl Alt Del requirement to take effect. Please restart at your earliest convenience."
    }
    
    exit $ExitCode
}
end {
    
    
    
}

 

How the Script Works

1. Preliminary Checks and Functions

• Administrator Privileges: The script ensures it runs with elevated privileges, critical for modifying registry keys and security policies.
• Domain Check: It verifies whether the device is domain-joined. For domain-joined machines, it advises using Group Policy instead of modifying local settings.
• Helper Functions:
• Test-IsDomainJoined determines domain membership.
• Set-RegKey handles registry modifications, ensuring keys exist and values are updated as needed.
• Test-IsElevated ensures administrative rights.

2. Registry Key Modifications

• The script disables AutoAdminLogon by setting its registry value to 0. This ensures that users cannot bypass authentication at startup.
• It also adjusts the DevicePasswordLessBuildVersion to enforce password use.

3. Security Policy Configuration

• The script exports the current security policy using SecEdit.exe and modifies it to enforce CTRL+ALT+DELETE login requirements.
• If Microsoft defaults are specified, the script resets the DisableCAD setting to allow bypassing CTRL+ALT+DELETE.

4. Policy Application

• After modifying the configuration file, the script reapplies the security policy to make the changes effective.
• If specified, it schedules a system restart to ensure the new settings take effect immediately.

5. Error Handling and Alerts

• The script checks for potential pitfalls, such as passwords stored in plain text or insufficient privileges, and provides actionable feedback.

Practical Applications for IT Professionals

Hypothetical Use Case

Consider an IT administrator managing workstations in a financial institution. To comply with security regulations, they must enforce CTRL+ALT+DELETE for login and disable automatic login across 50 devices. Instead of manually configuring each machine, they use this PowerShell script to automate the process. The script runs during off-peak hours, applying the changes uniformly and logging progress for accountability.

Comparing the Script to Other Methods

While this script provides a robust solution for standalone systems, domain-joined devices benefit from Group Policy, which offers centralized control and auditing. However, for non-domain systems or one-off configurations, the script outshines manual methods due to its automation and error-checking capabilities.

Frequently Asked Questions

Q1: Can this script be used on domain-joined systems?

The script advises against it, recommending Group Policy for better scalability and compliance.

Q2: What happens if the script is run without administrative privileges?

The script detects this scenario and exits gracefully, alerting the user to rerun it with elevated permissions.

Q3: Will the changes take effect immediately?

Most changes apply instantly, but a system restart is recommended for the CTRL+ALT+DELETE requirement to take full effect.

Q4: How can I revert the changes?

Use the -MicrosoftDefaults parameter to reset the settings to Microsoft’s default values.

Implications for IT Security

By enforcing CTRL+ALT+DELETE, organizations bolster their defenses against credential theft and spoofing attacks. Disabling automatic login reduces the risk of unauthorized access, especially on devices in shared or high-traffic areas. While this script addresses local configurations, it highlights the importance of layered security strategies in IT environments.

Recommendations for Using the Script

1. Test in a Controlled Environment: Before deploying widely, run the script on a test machine to ensure compatibility and desired outcomes.
2. Document Changes: Maintain logs of when and where the script is applied for future reference and auditing.
3. Integrate with Automation: Use tools like NinjaOne to schedule and monitor script execution across multiple devices.

Final Thoughts

Automating security configurations like disabling automatic login and enforcing CTRL+ALT+DELETE is a critical task for IT professionals. This script simplifies the process, ensuring compliance and enhancing security. For broader IT management needs, tools like NinjaOne can streamline such operations, offering centralized control, reporting, and automation to handle complex environments efficiently.