# Ensure 'Allow log on locally' is set to 'Administrators, Users'

Necessity: The 'Allow log on locally' policy setting determines which users can start an interactive session on the computer. Restricting this right is a fundamental security control that upholds the principle of least privilege. By limiting local logon capabilities, an organization can prevent unauthorized users from gaining console access, which mitigates risks associated with stolen credentials, insider threats, and lateral movement within a network. Misconfiguration could allow a compromised standard user account to be used to log onto a critical server or administrative workstation, significantly expanding an attacker's foothold.\n\nAuditing and Remediation: The audit script inspects the local security policy to identify and report the current list of accounts and groups assigned the 'SeInteractiveLogonRight' privilege. The remediation script directly modifies this policy, replacing the existing list with a new, more secure configuration provided as an argument. This ensures that only explicitly authorized principals can log on to the system's console.\n\nRecommended State Rationale:\n- Basic: ['Administrators,Users'] represents the default configuration for Windows client operating systems, suitable for general-purpose workstations where standard users need to log on to perform their duties.\n- Moderate: ['Administrators'] is the recommended secure state for servers and sensitive workstations, in line with CIS Benchmarks. Removing the generic 'Users' group ensures that only members of the 'Administrators' group can log on locally. This drastically reduces the attack surface by preventing a compromised non-administrative account from being used to gain an interactive session.\n- Strict: ['Administrators'] is the most secure and practical configuration. For this specific policy, the strict and moderate states are identical because further restrictions would likely impede legitimate administrative functions. Limiting local logon to only the 'Administrators' group enforces a strong security boundary, ensuring that console access is reserved for only the most privileged accounts.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Administrators,Users']` |
| **Moderate** | `['Administrators']` |
| **Strict** | `['Administrators']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the 'Allow log on locally' (SeInteractiveLogonRight) user right assignment. The script must convert the returned Security Identifiers (SIDs) to their account names and output a single string containing the comma-separated list of names (e.g., 'Administrators,Users'). The output must not include any labels, headers, or extra text.

## Remediation Script Working

PowerShell script that sets the 'Allow log on locally' (SeInteractiveLogonRight) user right. The script must accept a single, positional command-line argument: a comma-separated string of account names (e.g., 'Administrators,Users'). The script must apply this configuration and output '$true' upon successful completion or '$false' if an error occurs.

