# Ensure 'Network access: Do not allow anonymous enumeration of SAM accounts' is set to 'Enabled'

Necessity: The Security Account Manager (SAM) database stores user account information. Allowing anonymous enumeration of SAM accounts enables an unauthenticated attacker to retrieve a list of all user and group names on the system. This information is invaluable for reconnaissance, allowing attackers to identify potential targets for password guessing, brute-force attacks, or social engineering. Disabling this feature significantly hardens the system against information gathering.

Auditing and Remediation: The audit script checks the 'RestrictAnonymousSAM' registry value, which directly controls this policy. A value of '1' indicates the policy is enabled (secure), while '0' means it is disabled. The remediation script modifies this registry value to align the system with the desired security posture.

Recommended State Rationale: The recommendation for all levels (Basic, Moderate, and Strict) is 'Enabled'. This is a binary security setting with a clear best practice. There are no legitimate operational scenarios on a modern network that require anonymous users to list all accounts on a server. Therefore, enabling this restriction is a fundamental security measure that should be applied universally to prevent unauthorized system reconnaissance.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the value of 'RestrictAnonymousSAM' from the registry key 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'. The script must return only the numeric value, where '1' corresponds to 'Enabled' and '0' to 'Disabled'. If the value does not exist, the script should return '0'.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument ('1' for Enabled, '0' for Disabled) and sets the DWORD value for 'RestrictAnonymousSAM' at the registry path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'. The script must create the value if it does not exist. It must return '$true' on success and '$false' on failure.

