[Solved] Windows Explorer AutoPlay Not Disabled for the Default User Vulnerability

AutoPlay in Windows Explorer is a feature designed to simplify user interactions by automatically launching certain actions when external media or devices are connected. However, this feature can pose significant security risks if not properly disabled, especially for the default user configuration. This blog explores the vulnerability identified by Qualys ID 105171, “Windows Explorer AutoPlay not disabled for the default user,” and offers a comprehensive solution using PowerShell.

What is the Problem?

The default configuration for AutoPlay can leave systems exposed to:

Malware Propagation:

• Malicious actors can use USB drives or other external media to exploit AutoPlay and execute harmful scripts or applications.
• Unauthorized Code Execution: Automated execution of potentially malicious code without user consent.

When AutoPlay is not disabled for the default user, new user profiles inherit this insecure setting, propagating the vulnerability across all subsequent users on the system.

The Fix: A PowerShell Script

The provided PowerShell script addresses this issue by modifying the registry to disable AutoPlay for the default user profile. This ensures that all new profiles created on the system are protected.

PowerShell Script:
# Disable AutoRun on all drives

$registryPath = “HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer”
$registryPathUser = “HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer”

# Create the registry keys if they do not exist
if (-not (Test-Path $registryPath)) {
New-Item -Path $registryPath -Force
}

if (-not (Test-Path $registryPathUser)) {
New-Item -Path $registryPathUser -Force
}

# Set the NoDriveTypeAutoRun value to disable AutoRun on all drives
Set-ItemProperty -Path $registryPath -Name “NoDriveTypeAutoRun” -Value 0xFF
Set-ItemProperty -Path $registryPathUser -Name “NoDriveTypeAutoRun” -Value 0xFF

# Optionally, set NoAutorun to disable AutoRun completely
Set-ItemProperty -Path $registryPath -Name “NoAutorun” -Value 1

Step-by-Step Guide to Implementation

Step 1: Open PowerShell as Administrator

To modify registry settings, you need administrative privileges:

• Press Windows + S and type “PowerShell.”
• Right-click on Windows PowerShell and select Run as administrator.

Step 2: Save the Script

• Copy the script provided above.
• Save it as DisableAutoPlay_DefaultUser.ps1 using any text editor.

Step 3: Execute the Script

• Open PowerShell and navigate to the directory where the script is saved.
• Run the script by typing:
  .\DisableAutoPlay_DefaultUser.ps1

Step 4: Verify the Changes

• Open the Windows Registry Editor (regedit).
• Navigate to:
  HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer

Confirm the following values:

NoDriveTypeAutoRun: Set to 0xFF.

NoAutorun: Set to 1.

Step 5: Test the Configuration

• Insert a USB drive or external media. AutoPlay should no longer launch any action automatically. If it does, recheck the script and registry settings.

Why This Matters

Disabling AutoPlay for the default user ensures that:

1. New User Profiles Are Secure: Prevents the propagation of insecure settings.
2. Reduced Attack Surface: Eliminates one of the common entry points for malware.
3. Compliance: Helps meet organizational security standards and guidelines.

Additional Security Recommendations

System Updates: Ensure all Windows updates are applied to address other vulnerabilities.

Group Policy Enforcement: Use Group Policy to enforce this setting across an organization.

Regular Audits: Periodically review registry settings to ensure compliance.