Knowledge Base › Troubleshooting › Configuring Windows Auto-Logon for Unattended Token Access

Configuring Windows Auto-Logon for Unattended Token Access

Nov 2, 2026 · 3 views

You will learn how to configure Windows auto-logon so your dedicated OneSigner host machine automatically boots into the correct user session, allowing your hardware token to remain accessible for unattended PDF, folder watch, and REST API signing operations.

Understanding the Token Session Requirement

OneSigner operates as a Windows service alongside a graphical user interface that interacts with physical hardware tokens such as YubiKey, SafeNet, or ePass2003. The OneSigner service runs in Session 0, which has no access to smart cards or USB tokens. For each token signature it therefore launches the signing step inside the signed-in user's desktop session, where the token driver is available. If the host reboots after a power outage or Windows update and stops at the sign-in screen, there is no user session to run in, and token signing fails until someone signs in.

To prevent these failures, you must keep one dedicated Windows machine powered on with the physical token securely plugged into a USB port. For most local hardware token deployments, configuring Windows to automatically log in to a specific user account upon system startup ensures that the user session and token drivers are immediately initialized and ready to process incoming signing tasks without manual intervention.

Prerequisites and Safety Considerations

Before modifying system registry keys or utilizing automated configuration tools, verify that you have administrative access to the target Windows machine. You must also ensure that the physical token is plugged into a stable USB port on the host system and that the vendor drivers and middleware for your YubiKey, SafeNet, or ePass2003 token are fully installed and tested.

Configuring auto-logon through the Winlogon registry values (including OneSigner's built-in option) stores the Windows account password in the registry in plain text. Anyone with physical access to the machine or remote desktop access to the console could potentially access the unlocked desktop session. Therefore, restrict physical access to the signing machine, lock the server room or data rack, and review your overall security posture as outlined in License & Signing Security. If you encounter unexpected session termination issues during automated tasks, consult the troubleshooting steps for Signing Fails in Service Mode.

Configuring Auto-Logon from the OneSigner Config App

OneSigner can set this up for you:

  1. Open the OneSigner config app and go to the General tab.
  2. In the Auto-Logon group, tick Enable Auto-Logon.
  3. Enter the Username and Password of the account that should be signed in, and the Domain if the machine is domain-joined (leave it blank for a local account).
  4. Click Apply Auto-Logon, confirm the warning, and approve the Windows administrator (UAC) prompt.

Configuring Auto-Logon Manually via the Windows Registry

If you prefer to configure it by hand, the same result comes from the Winlogon registry key:

  1. Press the Windows Key + R combination on your keyboard to open the Run dialog box.
  2. Type regedit and press Enter to launch the Registry Editor. If prompted by User Account Control, click Yes to allow the application to make changes to your device.
  3. Navigate to the following registry key path using the left-hand navigation tree:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  4. Locate the string value named AutoAdminLogon. If it does not exist, right-click an empty space in the right pane, select New > String Value, and name it AutoAdminLogon. Double-click it and set its value data to 1.
  5. Locate or create a string value named DefaultUserName. Double-click it and enter the exact username of the account that should run OneSigner.
  6. Locate or create a string value named DefaultPassword. Double-click it and enter the cleartext password for that user account. (If this value does not exist, create it as a new String Value.)
  7. If your machine belongs to an Active Directory domain, locate or create a string value named DefaultDomainName and enter your domain name. For local accounts, omit or leave this value blank.

Once these registry values are correctly populated, close the Registry Editor. The settings take effect immediately upon the next system restart. For an alternative graphical approach without editing the registry directly, administrators often utilize Microsoft's official Sysinternals tool named AutoLogon, which stores the password as an encrypted LSA secret instead of plain text in DefaultPassword.

Verifying Unattended Operation and Success

After completing the registry configuration, you must test the setup to ensure the machine recovers correctly from a hard reboot without manual login intervention.

  1. Ensure your USB token (YubiKey, SafeNet, or ePass2003) is firmly inserted into the USB port of the OneSigner host machine.
  2. Open a command prompt as an administrator and issue a system restart command:
    shutdown /r /t 0
  3. Observe the machine as it reboots. Monitor the physical console or remote management interface to verify that the system bypasses the Windows login screen and automatically enters the desktop session for the designated user account.
  4. Check that the OneSignerService Windows service is running (for example in the Service Control group on the General tab of the OneSigner config app) and that your signing profile's certificate is still listed.
  5. Submit a test signing request via your configured watched folder or REST API endpoint to confirm end-to-end functionality.

When the system boots directly to the desktop and successfully processes a test document without user interaction, your unattended auto-logon configuration is complete. To review your overall installation parameters or verify your service configuration, refer back to the Installation Guide.