How is "phoenix-user" made?

Question

System administration

There is a computer on which the seller installed a pirated distribution of Windows XP Professional. The assembly is almost clean, the only difference is that the "user" autologin is preconfigured. I was interested, so to speak, for the general development of how it is done, because:

• If the user is deleted, it will be created on boot again
  
• control userpasswords2 and setting the checkbox "require username and password" does not help, after reboot the autologin will work, the checkbox will be removed by itself
  
• The only way I found to prevent Windows from auto-login this user is to disable his account (and a window will appear on the login screen with a message that your user is blocked)
  

Answer 1

Most likely, in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon
registry, in the DefaultUserName DefaultPassword AutoAdminLogon parameters, this user's autologin is set,
and user creation at boot can be seen by a script in group policies