# Ensure 'Interactive logon: Machine account lockout threshold' is set to '10 or fewer invalid logon attempts, but not 0'

The 'Interactive logon: Machine account lockout threshold' setting determines the number of failed logon attempts that will cause a machine account to be locked out. This is a critical defense against brute-force attacks targeting machine accounts, which can be used by attackers to gain unauthorized access to network resources. Misconfiguring this setting by setting it to 0 effectively disables the lockout policy, leaving the accounts vulnerable to unlimited password guessing attempts. The audit script checks the registry for the configured number of attempts, while the remediation script modifies this value to align with security policy. The recommended states provide tiered protection: Basic (10) offers a reasonable defense without being overly sensitive, Moderate (5) enhances security by reducing the window for attack, and Strict (3) provides the highest level of protection for high-security environments by minimizing the number of guesses an attacker can make before being locked out.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[10, 1]` |
| **Moderate** | `[5, 1]` |
| **Strict** | `[3, 1]` |
| **Type** | `RANGE` |

## Audit Script Working

PowerShell script to query the registry value at 'HKLM:\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\AccountLockout\MaxDenials'. The script must be configured to output only the numerical data of this registry value, with no additional text or formatting.

## Remediation Script Working

PowerShell script that accepts a single numerical value as a direct command-line argument. The script must use this argument to set the DWORD value for the registry key at 'HKLM:\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\AccountLockout\MaxDenials'. The script must return the boolean value '$true' upon successful modification or '$false' if an error occurs.

