Windows Explorer AutoPlay Not Disabled: Fix QID 105170 and 105171

Microsoft Windows Explorer AutoPlay Not Disabled means Windows acts automatically when removable or optical media is inserted, because the AutoPlay values are missing or too permissive. Fix it with Group Policy: enable “Turn off Autoplay” for All drives and set “Set the default behavior for AutoRun” to “Do not execute any autorun commands” (NoDriveTypeAutoRun = 0xFF, NoAutorun = 1).

What the scanner is actually detecting

This is a configuration check, not a missing patch: the scanner authenticates and reads registry values under the Explorer policy key.

Two values matter:

• NoDriveTypeAutoRun is a bitmask of drive types on which AutoPlay is disabled. Microsoft documents bits 0x04 removable, 0x08 fixed, 0x10 network, 0x20 CD-ROM and 0x40 RAM disk, plus 0x01/0x80 for unknown drive types; 0xFF (255) sets every bit. Selecting “CD-ROM and removable media drives” in the policy instead writes 0xB5, which fails the CIS, STIG and Microsoft baseline checks for “All drives”.
• NoAutorun controls whether autorun.inf commands run. A value of 1 means “Do not execute any autorun commands”, the value CIS and the DISA STIG require.

QID 105171 needs a word of explanation. Despite its title, HKEY_USERS.DEFAULT is not the template for new user profiles. It is an alias for HKEY_USERSS-1-5-18, the LocalSystem account’s hive, which Windows uses for the logon screen and for processes running as SYSTEM. The real new-user template is the NTUSER.DAT file in C:UsersDefault. Editing that file, or HKCU, does nothing for QID 105171.

Real-world risk

AutoRun earned its reputation: worms such as Conficker spread by dropping autorun.inf files on USB drives. Since Windows 7, Windows no longer offers the AutoRun task for media that is not optical (CD or DVD), so autorun.inf on a USB stick is no longer offered or executed automatically.

What remains is narrower: optical media, USB devices that present themselves as a CD drive, and AutoPlay handlers that open content as soon as media appears. All of these require someone to insert media, so this is a hardening baseline item rather than an emergency. It still matters for shared workstations, kiosks and servers with console access, and the CIS benchmarks and the DISA STIG (CAT I) require it. It belongs in a Windows Server hardening checklist.

How to confirm it on the host

From an elevated command prompt, read the values the scanner reads:

reg query "HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer" /v NoDriveTypeAutoRun
reg query "HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer" /v NoAutorun
reg query "HKU.DEFAULTSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer" /v NoDriveTypeAutoRun
reg query "HKU.DEFAULTSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer" /v NoAutorun

“ERROR: The system was unable to find the specified registry key or value.” means the setting is not configured, and the finding is valid. CIS, DISA STIG (WN10/WN11-CC-000190) and the Microsoft baseline audits require 0xFF, so any other value, including 0xB5, fails them. Qualys checks NoDriveTypeAutoRun under the two keys in the table; see the QID’s detection logic in your Qualys KB for whether it also reads NoAutorun or accepts other values. Setting 0xFF and NoAutorun = 1 in both hives covers either case. To see which GPOs reached the machine, run:

gpresult /r /scope computer

How to fix it

Domain-joined hosts: Group Policy

1. Edit a GPO linked to the target computers and go to Computer Configuration > Policies > Administrative Templates > Windows Components > AutoPlay Policies (in the local editor, gpedit.msc, the path starts at Computer Configuration > Administrative Templates).
2. Open Turn off Autoplay, select Enabled, and choose All drives under “Turn off Autoplay on”.
3. Open Set the default behavior for AutoRun, select Enabled, and choose Do not execute any autorun commands.
4. Enable Disallow Autoplay for non-volume devices, which blocks AutoPlay for MTP devices such as phones and cameras (NoAutoplayfornonVolume = 1 under HKLMSOFTWAREPoliciesMicrosoftWindowsExplorer). Required by DISA STIG (WN10/WN11-CC-000180, WN16-CC-000250, WN19/WN22-CC-000210, CAT I) and CIS Level 1 (18.10.8.1 in recent benchmarks); not needed to close the Qualys QIDs.

These policies exist under both Computer Configuration and User Configuration. Use Computer Configuration: it writes to HKLM, which is where the scanner looks, and it wins if the two conflict.

Standalone or workgroup hosts: registry

From an elevated prompt:

reg add "HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f
reg add "HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer" /v NoAutorun /t REG_DWORD /d 1 /f

On a domain-joined machine, a GPO that configures these settings differently will overwrite manual changes at the next refresh, so fix the GPO instead.

QID 105171: the .DEFAULT hive

Administrative Templates never write to HKEY_USERS.DEFAULT, so the GPO above does not clear QID 105171. Write the same two values there directly:

reg add "HKU.DEFAULTSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f
reg add "HKU.DEFAULTSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer" /v NoAutorun /t REG_DWORD /d 1 /f

To do this across a domain, use a Group Policy Preferences registry item: Computer Configuration > Preferences > Windows Settings > Registry, New > Registry Item, Action Update, Hive HKEY_USERS, Key Path .DEFAULTSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer, Value name NoDriveTypeAutoRun, type REG_DWORD, data 255 (decimal). Add a second item for NoAutorun with data 1. On each item’s Common tab, consider ticking Remove this item when it is no longer applied: it switches the Action to Replace, and it is what lets the values be removed later if the items are deleted or go out of scope.

Intune-managed devices

The same settings are exposed through the Autoplay Policy CSP (./Device/Vendor/MSFT/Policy/Config/Autoplay/TurnOffAutoPlay and ./Device/Vendor/MSFT/Policy/Config/Autoplay/SetDefaultAutoRunBehavior), which you can configure from the settings catalog. Use the device scope, not the user scope. The CSP is supported on Pro, Enterprise, Education and IoT Enterprise editions from Windows 10 version 1703, not on Home. For a custom OMA-URI, these ADMX-backed policies take a String value (<Format>chr</Format> in SyncML): <enabled/><data id="Autorun_Box" value="255"/> for TurnOffAutoPlay and <enabled/><data id="NoAutorun_Dropdown" value="1"/> for SetDefaultAutoRunBehavior. In AutoPlay.admx, Autorun_Box takes 181 (CD-ROM and removable, 0xB5) or 255 (all drives), and NoAutorun_Dropdown takes 1 (do not execute) or 2 (automatically execute). The .DEFAULT values for QID 105171 still need a script, such as the reg add lines above deployed as a platform script running as SYSTEM.

How to verify the fix and rescan

gpupdate /force
reg query "HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer" /v NoDriveTypeAutoRun

Expected output:

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
    NoDriveTypeAutoRun    REG_DWORD    0xff

NoAutorun should show 0x1, and the same two values should appear under HKU.DEFAULT. Microsoft notes that Explorer must restart before a NoDriveTypeAutoRun change takes effect in a running session, so sign out or restart Explorer if you want to test behavior by hand. The scanner only reads the registry, so no reboot is needed for the rescan. To check many hosts at once:

Invoke-Command -ComputerName (Get-Content .hosts.txt) -ScriptBlock {
    $k = 'SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer'
    $m = Get-ItemProperty -Path "HKLM:$k" -ErrorAction SilentlyContinue
    $d = Get-ItemProperty -Path "Registry::HKEY_USERS.DEFAULT$k" -ErrorAction SilentlyContinue
    [pscustomobject]@{
        HKLM_NoDriveTypeAutoRun    = $m.NoDriveTypeAutoRun
        HKLM_NoAutorun             = $m.NoAutorun
        Default_NoDriveTypeAutoRun = $d.NoDriveTypeAutoRun
        Default_NoAutorun          = $d.NoAutorun
    }
} | Select-Object PSComputerName, HKLM_*, Default_*

PowerShell shows the values in decimal: 255 and 1. Then run an authenticated Qualys scan against the hosts; QIDs 105170 and 105171 should move to Fixed. For Nessus, rerun the compliance scan and confirm the AutoPlay and AutoRun items show PASSED. If gpresult lists your GPO but the value is still wrong, a higher-precedence GPO is probably winning; see why a security GPO is not applying.

What can break and how to roll back

• Setup programs on CDs and DVDs no longer launch on insertion; users run setup by hand.
• Microsoft documents that HotStart buttons on some Windows 7-era laptops stop working with 0xFF. Its workaround, 0xB5, fails the CIS, STIG and baseline checks, so record a documented exception for any such models still in service.
• Devices that ship their driver installer on an emulated CD drive no longer start it automatically.
• The AutoPlay toggle in Settings stays visible and clickable. Microsoft confirms this is by design and that the policy takes precedence, so expect a few helpdesk questions.

Back up the keys before changing them. reg export does not create folders, so create C:Temp first. From an elevated Command Prompt (cmd.exe):

if not exist C:Temp mkdir C:Temp
reg export "HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer" C:Tempexplorer-policies-hklm.reg /y
reg export "HKU.DEFAULTSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer" C:Tempexplorer-policies-default.reg /y

If the .DEFAULT export fails with “ERROR: The system was unable to find the specified registry key or value.”, the key does not exist there yet and there is nothing to back up.

To roll back a GPO change, set the two policies back to Not Configured and run gpupdate /force. For values deployed with Group Policy Preferences, change each item’s Action to Delete and let it apply (gpupdate /force), then remove the items. Deleting or unlinking the items only removes the values if they were created with “Remove this item when it is no longer applied” ticked. For manual changes, delete the values in both hives; reg import alone will not remove values that did not exist before.

reg delete "HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer" /v NoDriveTypeAutoRun /f
reg delete "HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer" /v NoAutorun /f
reg delete "HKU.DEFAULTSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer" /v NoDriveTypeAutoRun /f
reg delete "HKU.DEFAULTSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer" /v NoAutorun /f

Common false positive reasons

True false positives are rare with this check. When the finding looks wrong, the value is usually not where the scanner reads it:

• Configured under User Configuration only. That writes to HKCU for each user, while QID 105170 and the compliance audits read HKLM.
• “CD-ROM and removable media drives” instead of “All drives”. The policy shows as Enabled, but the value is 0xB5, not 0xFF.
• QID 105171 still open after QID 105170 closed. The .DEFAULT hive was never written, or the change went to the Default user template or HKCU instead.
• Wrong type or path. The value is a string instead of REG_DWORD, or the key path has a typo (some published instructions misspell “Policies” as “Polices”).
• Stale results. The scan ran before the host picked up the GPO, or the host was offline during the refresh.

FAQ

Is AutoPlay still a real risk on Windows 10, Windows 11 and current Windows Server?

Lower than before Windows 7, because autorun.inf commands are no longer offered for USB storage. Optical media, CD-emulating devices and automatic handlers remain, and every major baseline still requires the setting, so fix it.

Does disabling AutoPlay block USB drives?

No. Drives still mount and files remain accessible. To control USB storage, use the Removable Storage Access policies, and consider the ASR rule “Block untrusted and unsigned processes that run from USB” (see moving ASR rules from audit to block mode).

Can I set only NoDriveTypeAutoRun and skip NoAutorun?

No. The two values do different jobs: NoDriveTypeAutoRun turns AutoPlay off per drive type, while NoAutorun stops autorun.inf commands. CIS and STIG audits check them as separate items, so set both.

Tracking this finding across many hosts

AutoPlay findings usually show up on every workstation and server at once, sometimes from more than one scanner. SITEY, a self-hosted vulnerability management platform, imports findings from 16 scanners and merges duplicates within each scanner (not across scanners). Its AI can write host-specific remediation scripts that pass through approval gates (human approval by default) before SITEY agents deploy them on Windows endpoints. Because this is a configuration check, confirm closure with a full authenticated Qualys scan or a Nessus compliance scan that uses the audit file.

Sources

• Microsoft Learn: Autoplay Policy CSP
• Microsoft Learn: Issues after Autoplay is disabled in Group Policy
• Microsoft Learn: Enabling and Disabling AutoRun
• Microsoft Learn (archived TechNet): NoDriveTypeAutoRun registry entry
• Microsoft DevBlogs (The Old New Thing): The .Default user is not the default user
• Tenable: Turn off Autoplay – NoDriveTypeAutoRun audit item