# Ensure 'Interactive logon: Machine inactivity limit' is set to '900 or fewer second(s), but not 0'

Necessity: This policy setting determines the period of user inactivity before the system automatically locks the session. Enforcing an inactivity limit is a critical defense-in-depth control against unauthorized physical access. If a user leaves their workstation unattended and unlocked, an unauthorized individual could gain access to sensitive data, install malicious software, or compromise the system and network. Setting this limit mitigates the risk of such opportunistic attacks by securing the session automatically. A value of '0' disables the feature entirely, leaving the machine vulnerable for an indefinite period.\n\nAuditing and Remediation: The audit script checks the current machine inactivity limit by reading the 'InactivityTimeoutSecs' value from the system registry. The remediation script directly modifies this registry value to enforce a specified timeout in seconds, ensuring the system complies with the security policy.\n\nRecommended State Rationale:\n- Basic ([1, 900]): This range establishes a minimum security baseline, locking the machine after 15 minutes (900 seconds) of inactivity. This is a common recommendation (e.g., CIS Benchmark) that balances security with user convenience, preventing sessions from remaining open for extended periods.\n- Moderate ([1, 600]): A 10-minute (600 seconds) timeout provides enhanced security by reducing the window of exposure. This is suitable for environments where the risk of unauthorized physical access is higher or where users handle more sensitive information.\n- Strict ([1, 300]): A 5-minute (300 seconds) timeout offers a very high level of security. It is recommended for high-risk environments, such as public-facing areas or systems processing highly confidential data, where the potential impact of a compromised session is severe and requires the shortest possible exposure time.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[900,1]` |
| **Moderate** | `[600,1]` |
| **Strict** | `[300,1]` |
| **Type** | `RANGE` |

## Audit Script Working

PowerShell script to query the 'InactivityTimeoutSecs' DWORD value from the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. The script must output only the raw numerical value. If the value does not exist or is not set, the script should output '0'.

## Remediation Script Working

PowerShell script that accepts a single positional integer argument representing the number of seconds. The script must set the 'InactivityTimeoutSecs' DWORD value at the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' to this argument. The script must return '$true' if the operation is successful and '$false' if it fails.

