What the "Fix" actually does for vulnerabilities

JeremyC

Some of you may have encountered this issue.

"Feature: Vulnerability

With automatic sign on after restart, your device saves the Windows credentials of the user last logged in and keeps them automatically logged in after a device restart. This could pose a risk to your privacy, as your data and device could be exposed to prying eyes in certain circumstances. We recommend you disable auto logins after the automatic restart to enhance your data's security and your privacy."

You click "fix" and then observe the following behavior:

In windows settings -> accounts -> sign-on options I see red text at the top of the page that says "*Some of these settings are hidden or managed by your organization."

You may ask support how to undo this (like I did). They may inadvertently provide an inaccurate answer along the lines of "the fix button doesn't do anything" and Bitdefender doesn't have permissions to make changes. I knew this was not accurate and that all antivirus software requires administrative access. I also know the product engineering team wouldn't go through the trouble of building out the scan and implementing a "fix" button that does nothing.

I decided to dig in and find out what, specifically, the "fix" button does here.

1) I built a fresh machine and installed Bitdefender

2) I performed a vulnerability scan

3) I used Regshot to capture state of the registry

4) I clicked the "fix" button for the above vulnerability

5) I used Regshot to capture the state of the registry again

6) I used Regshot to compare and found the following keys/values added:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableAutomaticRestartSignOn: 0x00000001

HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\System\DisableAutomaticRestartSignOn: 0x00000001

Note: You can simply delete the DisableAutomaticRestartSignOn key at both locations (no need to change the value) to revert this change and regain full access to your windows settings -> accounts -> sign-on options.

I provided this information to the support team and asked them to consider providing documentation on what the "fix" button does with each vulnerability.

Thanks,

Jeremy

Alexandru_BD

Hello @JeremyC,

Thank you so much for taking the time to share your findings with the community. It is much appreciated and your valuable feedback will reach our development teams, if you have already provided the information to the Support engineers.

Best regards