# Ensure 'Network access: Do not allow anonymous enumeration of SAM accounts and shares' is set to 'Enabled'

Necessity: This setting is crucial for preventing unauthorized information disclosure. When disabled, an unauthenticated, anonymous user can enumerate all Security Account Manager (SAM) account names and network share names on the server. This information provides attackers with a list of valid usernames for brute-force or password-spraying attacks and a map of network resources, significantly increasing the system's attack surface. The risk of misconfiguration is high, as it hands potential attackers the first piece of information needed to compromise the network. Auditing and Remediation: The audit script reads the specific registry key (HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\RestrictAnonymous) to determine if anonymous enumeration is blocked. A value of '1' indicates it is enabled. The remediation script directly modifies this registry key, setting its value to '1' to enable the protection or '0' to disable it. Recommended State Rationale: Basic: ['Enabled'] - This is the fundamental and universally recommended state. It aligns with CIS Benchmarks and Microsoft security best practices to prevent basic reconnaissance. Moderate: ['Enabled'] - There is no effective intermediate state. For any system with moderate security requirements, preventing information leakage to anonymous users is non-negotiable. Strict: ['Enabled'] - This is a binary security control; it is either secure ('Enabled') or insecure ('Disabled'). In a high-security environment, there is no acceptable reason to allow anonymous enumeration of accounts and shares. The setting must be 'Enabled' across all security postures.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the registry value 'RestrictAnonymous' at 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'. The script must check if the value is set to 1. If it is 1, the script should output 'Enabled'. If the value is 0 or does not exist, it should output 'Disabled'. The script must return only the string 'Enabled' or 'Disabled' and no other text or objects.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument, which must be either 'Enabled' or 'Disabled'. The script will configure the REG_DWORD value 'RestrictAnonymous' at 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'. If the argument is 'Enabled', the value should be set to '1'. If 'Disabled', it should be set to '0'. The script must return '$true' upon successful modification and '$false' if it encounters an error or receives an invalid argument.

