# Ensure 'Access Credential Manager as a trusted caller' is set to 'No One'

Necessity: The 'Access Credential Manager as a trusted caller' (SeTrustedCredManAccessPrivilege) user right allows a process to access and manage credentials securely on behalf of other users. Granting this privilege to unauthorized accounts creates a significant security risk. A malicious actor with this right could potentially access stored credentials, such as passwords, tokens, and certificates, leading to privilege escalation, data theft, and lateral movement within a network. The default and most secure configuration is to not assign this right to any account. Auditing and Remediation: The audit script inspects the local security policy to identify which accounts, if any, are granted this specific user right. The remediation script modifies the policy to remove any and all assigned accounts, thereby enforcing the 'No One' state. Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is 'No One', represented by an empty list of assignees. This is a binary setting in terms of security; any assignment introduces a high level of risk. There are no legitimate standard use cases for administrators or applications to be granted this right. Therefore, the only secure configuration is to leave it unassigned, adhering to the principle of least privilege.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['']` |
| **Moderate** | `['']` |
| **Strict** | `['']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that exports the local security policy to a temporary file. The script must parse this file to find the value associated with the 'SeTrustedCredManAccessPrivilege' setting. It should return only the comma-separated list of assigned principals (e.g., '*S-1-5-32-544'), or an empty string if no principals are assigned. The script must not output any extra text or labels.

## Remediation Script Working

PowerShell script that modifies the 'Access Credential Manager as a trusted caller' user right assignment ('SeTrustedCredManAccessPrivilege'). The script must accept a single, comma-separated string of SIDs or account names as a positional command-line argument. To set the policy to 'No One', the script must be invoked with an empty string argument (''). The script requires elevated privileges to apply the changes and must return $true on success or $false on failure.

