# Ensure 'Store passwords using reversible encryption' is set to 'Disabled'

Necessity: Storing passwords using reversible encryption is a significant security risk. This policy, when enabled, stores user passwords in a format that can be easily decrypted to their original plaintext form. If an attacker compromises the system and accesses the account database, they can recover the actual passwords instead of just their hashes. This allows the attacker to reuse these credentials to access other systems and services, facilitating lateral movement and deeper network compromise. This setting is only required for legacy applications using outdated authentication protocols like Challenge-Handshake Authentication Protocol (CHAP), which should be deprecated. The risk of exposing plaintext-equivalent passwords far outweighs the benefits of supporting these legacy protocols. Auditing and Remediation: The audit script inspects the system's local security policy to determine the current state of the 'ClearTextPassword' setting (0 for Disabled, 1 for Enabled). The remediation script directly modifies this policy, forcing it to the 'Disabled' state by creating and applying a security template with the `ClearTextPassword` value set to 0. Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is 'Disabled'. There is no scenario in a modern, secure environment where enabling this policy is justifiable. It is a fundamental security best practice, recommended by all major security frameworks (including CIS Benchmarks), to ensure passwords are never stored in a reversibly encrypted format. The distinction between hardening levels is not applicable here, as any state other than 'Disabled' introduces an unacceptable level of risk.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that exports the local security policy using `secedit.exe /export /cfg $path`. The script must parse the exported configuration file to find the value of the `ClearTextPassword` setting. It should output `Disabled` if the value is `0` and `Enabled` if the value is `1`. The script must only return the string `Disabled` or `Enabled`.

## Remediation Script Working

PowerShell script that accepts a single positional argument which must be either 'Enabled' or 'Disabled'. The script must configure the 'Store passwords using reversible encryption' policy by setting the `ClearTextPassword` value to `1` for 'Enabled' or `0` for 'Disabled'. This should be accomplished by creating a temporary security configuration file and applying it using `secedit.exe`. The script must return `$true` on success and `$false` on failure.

