| 1 | <?xml version='1.0' encoding='UTF-8'?>
|
|---|
| 2 | <!DOCTYPE topic PUBLIC "-//OASIS//DTD DITA Topic//EN" "topic.dtd">
|
|---|
| 3 | <topic xml:lang="en-us" id="autologon_win">
|
|---|
| 4 | <title>Automated Windows Guest Logins</title>
|
|---|
| 5 |
|
|---|
| 6 | <body>
|
|---|
| 7 | <p>
|
|---|
| 8 | Windows provides a modular system login subsystem, called
|
|---|
| 9 | Winlogon, which can be customized and extended by means of
|
|---|
| 10 | so-called GINA (Graphical Identification and Authentication)
|
|---|
| 11 | modules. In Windows Vista and later releases, the GINA modules
|
|---|
| 12 | were replaced with a new mechanism called credential providers.
|
|---|
| 13 | The Oracle VM VirtualBox Guest Additions for Windows come with both, a
|
|---|
| 14 | GINA and a credential provider module, and therefore enable any
|
|---|
| 15 | Windows guest to perform automated logins.
|
|---|
| 16 | </p>
|
|---|
| 17 | <p>
|
|---|
| 18 | To activate the Oracle VM VirtualBox GINA or credential provider
|
|---|
| 19 | module, install the Guest Additions using the command line
|
|---|
| 20 | switch <codeph>/with_autologon</codeph>. All the following
|
|---|
| 21 | manual steps required for installing these modules will be then
|
|---|
| 22 | done by the installer.
|
|---|
| 23 | </p>
|
|---|
| 24 | <p>
|
|---|
| 25 | To manually install the Oracle VM VirtualBox GINA module, extract the
|
|---|
| 26 | Guest Additions as shown in
|
|---|
| 27 | <xref href="windows-guest-file-extraction.dita">Manual File Extraction</xref>, and copy the
|
|---|
| 28 | <filepath>VBoxGINA.dll</filepath> file to the Windows
|
|---|
| 29 | <filepath>SYSTEM32</filepath> directory. In the registry, create
|
|---|
| 30 | the following key with a value of
|
|---|
| 31 | <filepath>VBoxGINA.dll</filepath>:
|
|---|
| 32 | </p>
|
|---|
| 33 | <pre xml:space="preserve">HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL</pre>
|
|---|
| 34 | <note>
|
|---|
| 35 | <p>
|
|---|
| 36 | The Oracle VM VirtualBox GINA module is implemented as a wrapper
|
|---|
| 37 | around the <filepath>MSGINA.DLL</filepath> standard Windows
|
|---|
| 38 | GINA module. As a result, it might not work correctly with
|
|---|
| 39 | third-party GINA modules.
|
|---|
| 40 | </p>
|
|---|
| 41 | </note>
|
|---|
| 42 | <p>
|
|---|
| 43 | To manually install the Oracle VM VirtualBox credential provider
|
|---|
| 44 | module, extract the Guest Additions as shown in
|
|---|
| 45 | <xref href="windows-guest-file-extraction.dita">Manual File Extraction</xref> and copy the
|
|---|
| 46 | <filepath>VBoxCredProv.dll</filepath> file to the Windows
|
|---|
| 47 | <filepath>SYSTEM32</filepath> directory. In the registry, create
|
|---|
| 48 | the following keys:
|
|---|
| 49 | </p>
|
|---|
| 50 | <pre xml:space="preserve">HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
|
|---|
| 51 | Authentication\Credential Providers\{275D3BCC-22BB-4948-A7F6-3A3054EBA92B}
|
|---|
| 52 |
|
|---|
| 53 | HKEY_CLASSES_ROOT\CLSID\{275D3BCC-22BB-4948-A7F6-3A3054EBA92B}
|
|---|
| 54 |
|
|---|
| 55 | HKEY_CLASSES_ROOT\CLSID\{275D3BCC-22BB-4948-A7F6-3A3054EBA92B}\InprocServer32</pre>
|
|---|
| 56 | <p>
|
|---|
| 57 | All default values, the key named <codeph>Default</codeph>,
|
|---|
| 58 | must be set to <codeph>VBoxCredProv</codeph>.
|
|---|
| 59 | </p>
|
|---|
| 60 | <p>
|
|---|
| 61 | Create the following string and assign it a value of
|
|---|
| 62 | <codeph>Apartment</codeph>.
|
|---|
| 63 | </p>
|
|---|
| 64 | <pre xml:space="preserve">HKEY_CLASSES_ROOT\CLSID\{275D3BCC-22BB-4948-A7F6-3A3054EBA92B}\InprocServer32\ThreadingModel</pre>
|
|---|
| 65 | <p>
|
|---|
| 66 | To set credentials, use the following command on a
|
|---|
| 67 | <i>running</i> VM:
|
|---|
| 68 | </p>
|
|---|
| 69 | <pre xml:space="preserve">$ VBoxManage controlvm "Windows XP" setcredentials "John Doe" "secretpassword" "DOMTEST"</pre>
|
|---|
| 70 | <p>
|
|---|
| 71 | While the VM is running, the credentials can be queried by the
|
|---|
| 72 | Oracle VM VirtualBox login modules, GINA or credential provider, using
|
|---|
| 73 | the Oracle VM VirtualBox Guest Additions device driver. When Windows
|
|---|
| 74 | is in <i>logged out</i> mode, the login modules
|
|---|
| 75 | will constantly poll for credentials and if they are present, a
|
|---|
| 76 | login will be attempted. After retrieving the credentials, the
|
|---|
| 77 | login modules will erase them so that the above command will
|
|---|
| 78 | have to be repeated for subsequent logins.
|
|---|
| 79 | </p>
|
|---|
| 80 | <p>
|
|---|
| 81 | For security reasons, credentials are not stored in any
|
|---|
| 82 | persistent manner and will be lost when the VM is reset. Also,
|
|---|
| 83 | the credentials are write-only. There is no way to retrieve the
|
|---|
| 84 | credentials from the host side. Credentials can be reset from
|
|---|
| 85 | the host side by setting empty values.
|
|---|
| 86 | </p>
|
|---|
| 87 | <p>
|
|---|
| 88 | Depending on the Windows guest version, the following
|
|---|
| 89 | restrictions apply:
|
|---|
| 90 | </p>
|
|---|
| 91 | <ul>
|
|---|
| 92 | <li>
|
|---|
| 93 | <p>
|
|---|
| 94 | For <b outputclass="bold">Windows XP guests.</b> The
|
|---|
| 95 | login subsystem needs to be configured to use the classic
|
|---|
| 96 | login dialog, as the Oracle VM VirtualBox GINA module does not
|
|---|
| 97 | support the Windows XP-style welcome dialog.
|
|---|
| 98 | </p>
|
|---|
| 99 | </li>
|
|---|
| 100 | <li>
|
|---|
| 101 | <p><b outputclass="bold">Windows Vista, Windows 7, Windows 8,
|
|---|
| 102 | and Windows 10 guests.</b> The login subsystem does
|
|---|
| 103 | not support the so-called Secure Attention Sequence,
|
|---|
| 104 | <codeph>Ctrl+Alt+Del</codeph>. As a result, the guest's
|
|---|
| 105 | group policy settings need to be changed to not use the
|
|---|
| 106 | Secure Attention Sequence. Also, the user name given is only
|
|---|
| 107 | compared to the true user name, not the user friendly name.
|
|---|
| 108 | This means that when you rename a user, you still have to
|
|---|
| 109 | supply the original user name as Windows never renames user
|
|---|
| 110 | accounts internally.
|
|---|
| 111 | </p>
|
|---|
| 112 | </li>
|
|---|
| 113 | <li>
|
|---|
| 114 | <p>
|
|---|
| 115 | Automatic login handling of the built-in
|
|---|
| 116 | <b outputclass="bold">Windows Remote Desktop
|
|---|
| 117 | Service</b>, formerly known as Terminal Services, is
|
|---|
| 118 | disabled by default. To enable it, create the following
|
|---|
| 119 | registry key with a <codeph>DWORD</codeph> value of
|
|---|
| 120 | <codeph>1</codeph>.
|
|---|
| 121 | </p>
|
|---|
| 122 | <pre xml:space="preserve">HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions\AutoLogon</pre>
|
|---|
| 123 | </li>
|
|---|
| 124 | </ul>
|
|---|
| 125 | <p>
|
|---|
| 126 | The following command forces Oracle VM VirtualBox to keep the
|
|---|
| 127 | credentials after they were read by the guest and on VM reset:
|
|---|
| 128 | </p>
|
|---|
| 129 | <pre xml:space="preserve">$ VBoxManage setextradata "Windows XP" VBoxInternal/Devices/VMMDev/0/Config/KeepCredentials 1</pre>
|
|---|
| 130 | <p>
|
|---|
| 131 | Note that this is a potential security risk, as a malicious
|
|---|
| 132 | application running on the guest could request this information
|
|---|
| 133 | using the proper interface.
|
|---|
| 134 | </p>
|
|---|
| 135 | </body>
|
|---|
| 136 |
|
|---|
| 137 | </topic>
|
|---|
