# Ensure 'Accounts: Limit local account use of blank passwords to console logon only' is set to 'Enabled'

Necessity: This setting is critical for preventing unauthorized remote access. Local accounts with blank passwords pose a significant security risk, as they can be easily exploited by attackers or malware to gain access to the system over the network. Enabling this policy ensures that any account with a blank password can only be used for interactive logons at the physical console, effectively blocking network-based attacks that attempt to leverage these insecure accounts. Misconfiguration leaves the system vulnerable to trivial brute-force attacks and unauthorized access via network services like Remote Desktop or file sharing.

Auditing and Remediation: The audit script checks the status of the DWORD value 'LimitBlankPasswordUse' within the HKLM registry hive to determine if the policy is active. The remediation script directly modifies this same registry value, setting it to '1' to enforce the policy and enable the security control.

Recommended State Rationale:
- Basic: ['Enabled']. This is the universally recommended baseline configuration (e.g., CIS Benchmarks). It provides a fundamental layer of protection against remote attacks targeting weak credentials.
- Moderate: ['Enabled']. As this is a binary security setting, there is no intermediate state. Enabling the policy is the only recommended configuration for any environment where security is a concern.
- Strict: ['Enabled']. The most secure posture is to have this control enabled. Disabling it is strongly discouraged in any production environment. While the ideal practice is to have no accounts with blank passwords, this setting acts as an essential compensating control to mitigate the risk if such an account exists.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry value 'LimitBlankPasswordUse' at 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'. The script should output 'Enabled' if the value data is 1, and 'Disabled' if the value data is 0 or the value does not exist. The script must return only the current state ('Enabled' or 'Disabled') with no extra text.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument which can be either 'Enabled' or 'Disabled'. The script must configure the 'Accounts: Limit local account use of blank passwords to console logon only' setting by setting the registry value 'LimitBlankPasswordUse' (REG_DWORD) at 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' to '1' for 'Enabled' or '0' for 'Disabled'. The script must return '$true' on successful modification and '$false' on failure.

