Skyrsoft Autologon Manager centrally manages automatic logon on Windows machines — the kiosks, digital-signage players, lab PCs, control-room displays and shop-floor terminals that need to come back to a signed-in desktop after every reboot with nobody there to type a password. Instead of the built-in AutoAdminLogon leaving that password in the registry, Autologon Manager keeps it encrypted on a server you run, rotates it on a schedule, and records every password reset, rotation and reveal in an audit trail.
Deploy it
The server runs on Windows Server against a PostgreSQL database you provision — the installer checks it’s reachable and rolls back if it isn’t. Download the free edition from the download page and run the server MSI. It installs a Windows service, applies its database migrations, and opens listeners for the admin console, the agent’s mutual-TLS channel, and the admin REST API. Complete first-run hardening — change the bootstrap admin password, set the API token, configure SSO or MFA — then open the Deploy page, download the agent installer and generate a one-time enrolment file to go with it. Install both on the target machine: the agent enrols itself, receives its own certificate, and starts polling. Set the auto-logon credential on the machine’s group and turn on the logon policy, and the credential provider signs the machine in at the next logon screen. Put the credential on a rotation schedule and Autologon Manager resets it at the source — in Active Directory or locally — and pushes the new value out, with every attempt recorded.
What it does
The capabilities below are grouped by what they do: hands-free logon and credential rotation, fleet-wide agent management, and running the console itself securely.
Limits worth knowing
- Windows x64 only. No macOS, no Linux, and no x86 or ARM64 Windows.
- The server is required. There is no server-less deployment, by design.
- One auto-logon credential per machine, for one job. It isn’t a PAM tool or a credential vault.
- Console SSO is OIDC only. No SAML or WS-Fed.
- One account per machine. Sharing one auto-logon account across machines is unsupported.
Auto-logon means a live session with nobody at the keyboard. That is the whole feature. What Autologon Manager removes is the plain-text password in the registry and the unaudited per-machine setup. A signed-in screen in an unlocked room is still a signed-in screen in an unlocked room, so physical access controls still matter. What the product defends, and what it accepts, is set out on the security page.
Logon
Hands-free Windows logon
The native credential provider, suppressing Windows' own auto-logon, auto-unlock, RDP coexistence, and the poll loop that keeps agents converged.
Credential storage and rotation
Setting a credential, resetting it at the source, scheduled rotation for AD and local accounts, per-agent overrides, and the audited reveal action.
Kiosk scheduling
Open-hours windows and discrete events that force logon, logoff or lock, evaluated in each machine's own local time.
Behaviour policies
The logon and lock-screen toggles — group defaults with a per-agent inherit, on or off override — and how they combine.
Fleet
Fleet management and groups
The Fleet table, the per-agent details page, policy groups, and the queued command channel with its own audit trail.
Deploying and upgrading agents
The self-service Deploy page and the WMI/DCOM-and-SMB push job for batches, both gated by a scoped enrolment token, plus in-place agent upgrades.
Agent identity and mutual TLS
How enrolment decides a machine's identity — Kerberos for domain agents, a capped token-only fallback for workgroup ones — and the internal CA behind every agent-server call.
Remote diagnostics
Verbose provider-and-agent logging streamed back over the existing mTLS channel, viewable or downloadable in the console, off by default and purged on disable.
Run it securely
Console TLS certificates
Self-signed, built-in ACME DNS-01, or a certificate pushed in or uploaded under Manual mode, plus hostname pinning, HSTS and the admin API token that gates the push.
Single sign-on, MFA and roles
Okta, Entra ID, Google Workspace, AD FS or generic OIDC (one active at a time), per-provider role mapping and account lifecycle, TOTP/passkey MFA, two roles, and break-glass recovery.
Licensing and offline operation
What validation sends, what activation and renewal need, and why offline never revokes an activated licence.