[VCL-885] Windows.pm::sanitize_files doesn't remove password if default changed since capture

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.4.2
• Fix Version/s: 2.5
• Component/s: vcld (backend)
• Assignee: Andrew Kurth
• Reporter: Andrew Kurth
• Created: 14/Jul/15 19:27
• Updated: 12/Aug/15 17:12
• Resolved: 14/Jul/15 19:29

Description

The password of the root and Administrator accounts in Windows images get set to a known value stored in vcld.conf when an image is captured. These accounts' passwords are randomized after an image is loaded.

There is at least one script (autologon_enable.cmd) stored in Windows images which contains the default password. Windows.pm::sanitize_files attempts to remove the default password from this script and other files it finds under C:\Cygwin\home\root.

If the default password is changed in vcld.conf after an image is captured, the old password will not be removed from the files because the VCL process only searches for the current value. This should be improved.