[Solved] Microsoft Windows Explorer AutoPlay Not Disabled Vulnerability

AutoPlay in Windows Explorer is a convenience feature that simplifies the handling of media and devices by automatically executing predefined actions. However, if not disabled system-wide, this feature can leave systems vulnerable to exploitation. This blog focuses on the vulnerability identified by Qualys ID 105170, “Microsoft Windows Explorer AutoPlay not disabled,” and provides a detailed guide to mitigating this risk using a PowerShell script.

Understanding the Vulnerability

When AutoPlay is enabled globally, it increases the risk of:

Malware Infections: USB drives and external media can be used to execute malicious scripts automatically.

Unauthorized Code Execution: AutoPlay can bypass user consent, running harmful programs without manual intervention.

Disabling AutoPlay system-wide ensures that no user account, including administrators, can inadvertently enable this functionality.

The Solution: PowerShell Script

The following PowerShell script modifies registry settings to disable AutoPlay at the system-wide level. This approach prevents the feature from being used as an attack vector.

PowerShell Script:
# Disable AutoRun on all drives

$registryPath = “HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer”
$registryPathUser = “HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer”

# Create the registry keys if they do not exist
if (-not (Test-Path $registryPath)) {
New-Item -Path $registryPath -Force
}

if (-not (Test-Path $registryPathUser)) {
New-Item -Path $registryPathUser -Force
}

# Set the NoDriveTypeAutoRun value to disable AutoRun on all drives
Set-ItemProperty -Path $registryPath -Name “NoDriveTypeAutoRun” -Value 0xFF
Set-ItemProperty -Path $registryPathUser -Name “NoDriveTypeAutoRun” -Value 0xFF

# Optionally, set NoAutorun to disable AutoRun completely
Set-ItemProperty -Path $registryPath -Name “NoAutorun” -Value 1

Step-by-Step Guide to Implementation

Step 1: Open PowerShell as Administrator

To make system-wide changes, administrative privileges are required. Follow these steps:

• Press Windows + S and type “PowerShell.”
• Right-click on Windows PowerShell and select Run as administrator.

Step 2: Save the Script

• Copy the script provided above.
• Save it as DisableAutoPlay_SystemWide.ps1 using any text editor.

Step 3: Execute the Script

• Open PowerShell and navigate to the directory where the script is saved.
• Run the script by typing:
  .\DisableAutoPlay_SystemWide.ps1

Step 4: Verify the Changes

• Open the Windows Registry Editor (regedit).
• Navigate to:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer

Confirm the following values:

NoDriveTypeAutoRun: Set to 0xFF.

NoAutorun: Set to 1.

Step 5: Test the Configuration

Insert a USB drive or external media. AutoPlay should no longer launch any action automatically. If it does, revisit the script and registry settings.

Why This Matters

Disabling AutoPlay system-wide ensures:

1. System-Wide Protection: No user, regardless of privileges, can use AutoPlay.

2. Mitigation of Malware Risks: Prevents malicious media from exploiting the feature.

3. Compliance: Aligns with best practices for IT security management.

Additional Security Measures

Educate Users: Inform users about the risks of connecting unknown USB devices.

Use Endpoint Protection: Deploy security software to detect and block malicious media.

Regular Reviews: Conduct periodic audits to confirm that AutoPlay remains disabled.