# Ensure 'Accounts: Block Microsoft accounts' is set to 'Users can't add or log on with Microsoft accounts'

Necessity: In an enterprise or managed environment, it is crucial to control the types of accounts used on corporate devices. Allowing users to add or log on with personal Microsoft accounts can lead to data leakage, as files can be easily saved to personal OneDrive storage, bypassing organizational data loss prevention (DLP) controls. It also blurs the line between corporate and personal identities on the device, complicates access management, and can introduce security risks from accounts that are not managed under corporate security policies. Misconfiguration risks data exfiltration, shadow IT, and weakened identity and access management. Auditing and Remediation: The audit script checks the registry value 'NoConnectedUser' to determine the current policy state ('0' for disabled, '1' for blocking adding accounts, '3' for blocking adding and logging on). The remediation script directly modifies this registry value to enforce the desired configuration. Recommended State Rationale: The Basic, Moderate, and Strict recommendation is '3' ('Users can't add or log on with Microsoft accounts'). This is because the security benefit is binary; either unmanaged personal accounts are blocked, or they are not. This state is the recommendation from security benchmarks like CIS. It enforces a strict corporate-identity-only model on the endpoint, which is the fundamental goal of this control. There are no intermediate states that provide a meaningful increase in security; therefore, the most secure configuration is recommended for all hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['3']` |
| **Moderate** | `['3']` |
| **Strict** | `['3']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry value 'NoConnectedUser' at 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. If the value does not exist, the script should return '0'. Otherwise, it should return the existing DWORD value. The output must only be the numerical value, with no extra text or formatting.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument representing the desired state ('0', '1', or '3'). The script must set the DWORD registry value 'NoConnectedUser' at 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' to the provided argument. The script must create the key if it doesn't exist. It must return '$true' upon successful modification and '$false' if it fails.

