# Ensure 'Network security: Minimum session security for NTLM SSP based (including secure RPC) clients' is set to 'Require NTLMv2 session security, Require 128-bit encryption'

Necessity: This policy setting determines the minimum security standards for NTLM-based client applications. The NTLM Security Support Provider (SSP) is used for network authentication. If this policy is not configured with strong settings, an attacker could perform man-in-the-middle (MitM) attacks to intercept, downgrade, and capture authentication credentials or session data. Enforcing NTLMv2 and 128-bit encryption mitigates risks associated with weak or broken legacy authentication protocols like NTLMv1 and LM.

Auditing and Remediation: The audit script checks the current configuration by reading the value of the 'NtlmMinClientSec' registry key, which is a bitmask representing the enforced security level. The remediation script directly modifies this registry value to align the system with the desired security posture, enforcing stronger authentication and session protection.

Recommended State Rationale:
- Basic: A value of '524288' ('Require NTLMv2 session security') is the minimum acceptable baseline. It mandates the use of the more secure NTLMv2 protocol, which is resistant to common NTLMv1 cracking techniques. However, it does not enforce session data encryption.
- Moderate: A value of '537395200' ('Require NTLMv2 session security, Require 128-bit encryption') is the recommended state by security benchmarks like CIS. This level ensures not only that the secure NTLMv2 protocol is used but also that all session traffic is protected by strong 128-bit encryption, providing both authentication security and data confidentiality.
- Strict: This level is the same as Moderate because '537395200' represents the highest security level available for this specific policy. Enforcing this state provides the maximum protection against NTLM-based MitM and session hijacking attacks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['524288']` |
| **Moderate** | `['537395200']` |
| **Strict** | `['537395200']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the DWORD value of the registry key 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\NtlmMinClientSec'. The script must output only the current decimal value, with no additional text or formatting.

## Remediation Script Working

PowerShell script that sets the DWORD value of the registry key 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\NtlmMinClientSec'. The script must accept the desired decimal value as a direct, positional command-line argument. It must return '$true' on successful modification and '$false' on failure.

