# Ensure 'Interactive logon: Prompt user to change password before expiration' is set to 'between 5 and 14 days'

Necessity: This setting determines how many days before a password expires a user will be prompted to change it. A properly configured warning period is crucial to prevent unexpected account lockouts, which can disrupt user productivity and increase IT support workload. If the warning is too short or non-existent, users may be forced to change their password under pressure or find themselves locked out at a critical moment, leading to downtime. This policy ensures a smooth transition for password changes, contributing to both operational efficiency and user satisfaction. Auditing and Remediation: The audit script reads the 'PasswordExpiryWarning' DWORD value from the Winlogon registry key to determine the current warning period in days. The remediation script directly modifies this same registry value to align the system with the desired policy. Recommended State Rationale: Basic ([5, 14]): This range aligns with industry best practices, including CIS Benchmarks, providing a minimum of one business week's notice. It serves as a fundamental safeguard against sudden password expiration. Moderate ([7, 14]): Recommending a warning period starting at 7 days gives users a full calendar week to respond. This accommodates for weekends or short absences, significantly reducing the likelihood of a user missing the prompt. Strict ([14, 14]): A 14-day warning period offers the maximum advance notice, which is ideal for environments with users who may not log in daily, such as remote workers or frequent travelers. This proactive approach minimizes disruptions and provides ample time for users to thoughtfully create a new, strong password, thereby enhancing overall security posture.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[14, 5]` |
| **Moderate** | `[10, 5]` |
| **Strict** | `[5, 5]` |
| **Type** | `RANGE` |

## Audit Script Working

PowerShell script that retrieves the 'PasswordExpiryWarning' value from the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon'. The script must output only the numerical value, with no additional text or formatting. If the value does not exist, the script should output nothing.

## Remediation Script Working

PowerShell script that accepts a single integer as a positional command-line argument. The script must use this argument to set the 'PasswordExpiryWarning' DWORD value at the registry path 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon'. The script must return the boolean value '$true' upon successful modification or '$false' if it fails.

