Galen
Mon Nov 06 07:36:36 CST 2006
In news:eOtmoKaAHHA.4212@TK2MSFTNGP02.phx.gbl,
smith had this to say:
My reply is at the bottom of your sent message:
> I have done what you said. But...I still wonder if the operation is an
> automatic login with *remembered password*. It seems that it is a
> automatic login without any password which is not any secure
> measurement for the system login. Would it make Administrator
> account logined automatically without any password?
>
> Thanks.
Automated login with or without a password is not secure at all. Even if you
are the only person who has access to your PC right now that's not
preventing anyone from accessing it when you're not there or from stealing
it and accessing your account (and files, information, banking information,
any saved passwords, etc) at their leisure.
The option that you've enabled - which automatically logs the profile
selected in - is the only option you have to enable the automatic
recollection of the profile password. There aren't any other options, be the
password blank or 256 characters and symbols long, it logs in automatically
and there's no security involved regardless. That means anyone who turns on
your PC can use it. With your account. With your information. A password as
strong as is possible is no good if it is taped to the monitor, under the
desk, or input automatically.
Using a password on the PC isn't going to do you any good for protecting vs.
remote attacks realistically. (Unless, of course, you have a WOL with a VNC
setup that loads pre-OS which would just be plain silly anyhow so we'll
ASSUME you don't have such.) Password protected accounts, EFS, and proper
permissions for the file system are the only defense you have built in with
the OS to keep your system physically secured. (EFS is a no-go with XP Home
by the way.)
If you want multiple accounts listed on the welcome page and want to be able
to log in to any of them without a problem then, well, just remove their
passwords - you can't make it autofill those passwords if that's your goal
but it will happily log you in (and be insanely insecure) simply by clicking
the account (and maybe hitting enter if it asks for a password) if you
simply remove the passwords. Again, doing so is really not the best
solution.
--
Galen - MS MVP - Windows (Shell/User & IE)
http://dts-l.org/ http://kgiii.info/
"Chance has put in our way a most singular and whimsical problem, and
its solution is its own reward." - Sherlock Holmes