# Ensure 'Microsoft network server: Disconnect clients when logon hours expire' is set to 'Enabled'

Necessity: This policy is crucial for enforcing time-based access controls. It determines whether users connected to the server are forcibly disconnected when their configured logon hours expire. If this setting is disabled, a user who logs in during their valid hours can remain connected and access resources indefinitely, completely bypassing the logon time restrictions. This creates a significant security gap, allowing for potential unauthorized access to sensitive data outside of approved operational windows.\n\nAuditing and Remediation: The audit script checks the registry value 'EnableForcedLogoff' under the LanmanServer parameters key to determine its current state (1 for Enabled, 0 for Disabled). The remediation script directly modifies this registry value to align the system with the desired security policy, ensuring that logon hour restrictions are strictly enforced.\n\nRecommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is 'Enabled'. There is no intermediate state for this control; it is either enforced or it is not. Disabling this feature negates the entire purpose of setting logon hours for user accounts. Therefore, to maintain a secure environment and ensure that time-based access policies are effective, this setting must be enabled. This aligns with the principle of least privilege, applying it to the time of access.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry value 'EnableForcedLogoff' at 'HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters'. The script should output 'Enabled' if the value data is 1, and 'Disabled' if the value data is 0 or the value does not exist. The output must only be the current state string, with no additional text.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument: 'Enabled' or 'Disabled'. The script will configure the 'EnableForcedLogoff' DWORD value at 'HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters', setting its data to 1 for 'Enabled' and 0 for 'Disabled'. The script must return $true on success and $false on failure.

