# Ensure 'Interactive logon: Do not require CTRL+ALT+DEL' is set to 'Disabled'

Necessity: Requiring CTRL+ALT+DEL is a fundamental security measure known as the Secure Attention Sequence (SAS). This key combination is intercepted only by the Windows kernel, ensuring that the login prompt presented to the user is genuine and not a malicious program spoofing the interface to capture credentials. Disabling this requirement exposes the system to sophisticated phishing and credential theft attacks.

Auditing and Remediation: The audit script checks the value of the 'DisableCAD' registry entry to determine the current state. The remediation script modifies this same registry value, setting it to 0 to enforce the CTRL+ALT+DEL requirement ('Disabled') or to 1 to remove it ('Enabled').

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is 'Disabled'. This is a binary security control with no middle ground. The 'Disabled' state enforces the SAS, which is a critical protection against credential spoofing. Security benchmarks like the CIS Benchmarks universally recommend enforcing this control. Enabling the setting (not requiring CTRL+ALT+DEL) offers no security benefit and introduces a significant, unnecessary risk, making it inappropriate for any security-conscious environment.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the registry key 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' for the 'DisableCAD' value. The script should return 'Disabled' if the value is 0 or does not exist, and 'Enabled' if the value is 1. The output must only be the string 'Enabled' or 'Disabled', with no other text.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument, which must be either 'Enabled' or 'Disabled'. The script must configure the 'Interactive logon: Do not require CTRL+ALT+DEL' setting by setting the registry value 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCAD' to 1 for 'Enabled' or 0 for 'Disabled'. The script must create the REG_DWORD value if it does not exist. It must return '$true' on success and '$false' on failure or if an invalid argument is provided.

