{"id":3343,"date":"2025-07-26T16:40:17","date_gmt":"2025-07-26T08:40:17","guid":{"rendered":"https:\/\/www.jhouseconsulting.com\/?p=3343"},"modified":"2025-08-22T21:48:37","modified_gmt":"2025-08-22T13:48:37","slug":"priming-a-non-persistent-windows-image-using-an-autologon-process-with-an-auto-logoff-timer","status":"publish","type":"post","link":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/2025\/07\/26\/priming-a-non-persistent-windows-image-using-an-autologon-process-with-an-auto-logoff-timer-3343","title":{"rendered":"Priming a Non-persistent Windows Image using an Autologon Process with an Auto Logoff Timer"},"content":{"rendered":"\n

Several years ago, and inspired by an article<\/a> written by George Spiers<\/a> to reduce login times, where “the second logon is quicker”, together with some code<\/a> from Maurice Daly<\/a>, I created a methodology and scripts that is designed to Autologon a non-persistent Session Host (both VDI and RDS), and then log it off again before another script will Start the Citrix Desktop Service (BrokerAgent)<\/a>.<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

It has been working flawlessly for years. However, I was never 100% happy with it because the process was using a domain (service) account for the Autologon process. The main challenge here was trying to change the password on a regular basis to stay compliant when managing multiple images. You cannot realistically do it without an outage. And in a 24×7 environment, it becomes difficult and onerous. I also felt that using a domain account can be “heavy” during a boot storm as you need to ensure you are excluding this account from profile management and policies where possible. Sometimes that is easier said than done. There is a level of risk here, as someone can easily make a change that will cause issues. The ability to roll the password and stay compliant was my biggest concern and where I got stuck for quite some time.<\/p>\n\n\n\n\n\n\n\n

I spent a lot of time whiteboarding the process flow and all the moving parts (the scripts, registry values involved, etc). I realised that the only way to address this was to have a local account with a strong secure password (stored as an LSA Secret) that changes every time you rebuild the image, or re-run the script. You never need to record or know the password, and it can be different for each image. The local account is added to the local Users group by default, as there is no need for it to be a local Administrator. If you have the \u201cAllow log on locally\u201d policy set that excludes the local Users group, you\u2019ll either need to adjust this policy or add the user to the appropriate local group that allows them to logon locally. If needed there is a variable you can set that will add the account to the local Administrators group. The only constant needs to be the name of the local account so that it works in conjunction with my Start the Citrix Desktop Service (BrokerAgent) script.<\/a><\/p>\n

Then I got caught out by the Winlogon DefaultDomainName registry value without even realising that since Windows Vista and Server 2008 R1 it was no longer used to set the default logon Domain for the computer. Silly me! I had a Group Policy that would apply the Domain Name to this value by a registry preference, as that was once a best practice. So this would fill the DefaultDomainName registry value, breaking the Autologon of a local account. Together with these scripts and changes I made to the Start the Citrix Desktop Service (BrokerAgent) script<\/a>, I was finally able to get the process working as needed.<\/p>\n

Maybe these scenarios is also why Microsoft moved this Winlogon DefaultDomainName dependency starting from Windows Vista and Server 2008 R1 to a different registry location controlled by the “Assign a default domain for logon<\/a>” group policy setting.<\/p>\n\n\n\n

Now that I’ve overcome these challenges, I’m happy to share the scripts and process.<\/p>\n

Here is a video of a Session Host starting up, auto logging on using a local account named PrimeMySystem, and then auto logging off gracefully.<\/p>\n\n\n\n

\n