# Ensure 'Network access: Do not allow anonymous enumeration of SAM accounts and shares' is set to 'Enabled'

Necessity: This setting is crucial for preventing unauthorized information gathering. When disabled, an unauthenticated attacker can anonymously enumerate Security Account Manager (SAM) account names and network shares. This information provides a valuable list of potential targets for brute-force attacks, password spraying, or identifying high-value users and resources, serving as a critical reconnaissance step for further network compromise. The risk of misconfiguration is a significant information disclosure vulnerability.

Auditing and Remediation: The audit script checks the registry key HKLM:\SYSTEM\CurrentControlSet\Control\Lsa for the value of 'RestrictAnonymousSAM' to determine if anonymous enumeration is permitted. The remediation script directly modifies this registry value to either 1 (Enabled) or 0 (Disabled), thereby controlling this security policy.

Recommended State Rationale: 
- Basic: ['Enabled'] - This is the fundamental recommended state according to security benchmarks like CIS. Enabling this policy is a baseline security measure that significantly reduces the system's attack surface by denying anonymous users basic reconnaissance capabilities.
- Moderate: ['Enabled'] - For this binary security setting, there is no effective intermediate state. The 'Enabled' state is the only secure configuration, making it the standard for a moderately hardened system.
- Strict: ['Enabled'] - In a strict security environment, preventing any form of unauthorized information leakage is paramount. 'Enabled' is the only acceptable state, as disabling it would introduce an unnecessary and easily exploitable risk.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry value 'RestrictAnonymousSAM' at the path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'. The script must return 'Enabled' if the value data is 1, and 'Disabled' if it is 0 or does not exist. The output must contain only the state string, with no extra text or formatting.

## Remediation Script Working

PowerShell script that accepts a single positional argument ('Enabled' or 'Disabled'). The script must set the registry value 'RestrictAnonymousSAM' (DWORD) at 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' to 1 for 'Enabled' and 0 for 'Disabled'. The script must return $true upon successful modification and $false otherwise.

