Is a password protected
Windows Log in Secure? Hi everyone.
Leo Notenboom here for askleo.com. Let me read you the question.
"I use Windows on two desktops and a laptop.
Up until now, I've never bothered using the password when logging on,
but recently I was cautioned to use a Windows Log on password.
When I brought the laptop,
the shop where I purchased it said this was for security in case someone took it.
They also said the use of a password
on my home PCs would prevent malware from being automatically installed
should I inadvertently do something.
Is this true?
I asked because a year ago I tried
to close a pop up ad using the red X button and unknowingly installed malware.
I now use Task Manager for such operations, but the bad guys keep changing
what they do so that solution may someday no longer work."
I'm going to put it this way.
The security that's offered by Windows login password is highly overrated.
It actually doesn't protect you from many
of the things that you just mentioned, and it's pretty darn easy to circumvent.
You should probably have one. With the migration to Microsoft accounts.
You probably already have one,
but just be aware of what it does and doesn't get you.
The big one that I think people need to understand is that if your laptop or
your computer gets stolen, the password that you have on your Windows
account doesn't really protect you from much.
The thief can remove the hard drive
and attach it to a different machine and start looking at all your files.
Or they can boot from a live Linux CD or USB or some other kind of recovery disk
and still be able to get everything that's on the machine.
If someone takes your laptop if someone
takes your computer, they just don't need your password.
This highlights the importance of what I call physical security.
If it's not physically secure, it's not secure.
Now, the one thing you might want
to consider doing in that situation, especially if you've got a laptop,
and theft is a real concern, is to use BitLocker on the drive,
because then yes, the drive is controlled by your Windows login.
Your ability to access the drive is controlled by your Windows login.
If they can't log in, if there is no
way for them to sign into the machine using whatever account you use and its
password and the contents of the drive are just random noise, they can't see it.
But that's the only case, really, where a Windows login gets you something
secure, and it really does rely on you having taken the time to install or set up
BitLocker or some other form of whole disk encryption for that to take place.
Now, other than that, I actually liken the Windows login to a cheap padlock.
There are ways to get around it.
If you haven't used something like BitLocker, there are ways to reset.
For example, the administrator password if you can boot into the machine some other
way, it's just not that big a deal when it comes to security.
I want to address the malware scenario
that you were talking about earlier, and that's a complete no.
This doesn't help at all.
Let's face it, when you are threatened
by malware, it's because you're doing something you're logged in.
So the malware that you might run is running as you
the fact that you have or don't have
a password on your Windows account really makes no difference.
It's happening as you're accessing the machine, as you're doing things.
And sure, there are other vulnerabilities
that can come in, potentially through the network and so
forth, but those, by their definition, are vulnerabilities that are hopefully
going to get patched once they're discovered.
But the point is that they're independent of a Windows login.
A Windows login doesn't help.
Windows login doesn't hurt.
It just is not something you should
consider even when it comes to keeping your machine safe and secure for malware.
The right Thing There are your own best habits using up to date security software,
keeping your entire system as up to date as possible.
The usual stuff we talk about here often.
So,
what that does, though,
is that does open the door to is an automatic login a thing?
Is that a safe thing to do?
That's a case where your Windows account
does have a password, but you've configured it so that when you
reboot your machine, your account automatically logs in.
If the machine is secure from your
perspective, physically secure, nobody's going to walk up to the machine
that you don't trust, then that may be an okay thing to do.
And because Microsoft accounts require
a password, that's about the only way you're going to bypass the need to enter
a password when you reboot a machine by enabling this automatic login.
But only do that if you can be certain that it's okay for someone with access
to the machine to reboot it, and then be automatically logged in as you.
So if you want the machine to be secure,
for example, I'll use the laptop scenario again.
If you really want the machine to be secure in case it gets stolen or something
else happens to it, it's a two step process.
One, you're going to have a login to your account anyway.
You're going to need a password, probably a Microsoft account.
Make sure that that's required.
Do not enable automatic login of any shape or form.
And second, enable BitLocker, because, like I said, they don't need your password
to access your disk unless you've enabled whole disk encryption of some sort.
And bit locker included in Windows Ten Pro or Windows Eleven Pro and better is fine.
That's a perfectly good solution.
And like I said, I'll reiterate the common
litany of things that are the ways to keep your machine secure.
That is, having good up to date security
software windows defender is great for most people Microsoft security built
into Windows keep all of your software, Windows itself, your security software,
your applications, everything as up to date as possible.
Be skeptical and on guard.
This is where Malware tends to sneak in.
Most of the time they fool people
into opening attachments from emails that they weren't expecting or doing all
sorts of things that basically bypass the best security in the world because
it's the user saying do this, we assume that the user knows what they're
doing, even though that isn't necessarily the case.
And finally, of course, it wouldn't be Ask Leo if I didn't talk
about it back up regularly so that if something goes wrong,
you've got the opportunity to restore whatever it is you had on your machine
at the time the backup was taken hope that was helpful.
I hope that gives you a better sense
of what to expect and not to expect out of a Windows login for Updates For related
links, for comments and more, visit askleo.com/4231.
I'm Leo Notenboom and this is askleo.com.
Thanks for watching.