# Ensure 'Microsoft network server: Disconnect clients when logon hours expire' is set to 'Enabled'

Necessity: This policy setting is crucial for enforcing time-based access controls. When logon hours are configured for user accounts, this setting determines whether users who are already logged in are forcibly disconnected when their permitted logon time expires. If this is disabled, users can remain connected and active indefinitely beyond their authorized hours, undermining security policies and potentially allowing unauthorized activity to occur outside of monitored periods. Enabling it ensures that time restrictions are strictly enforced.

Auditing and Remediation: The audit script checks the registry value 'EnableForcedLogoff' within 'HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters' to determine the current state. A value of 1 corresponds to 'Enabled', while 0 or non-existence corresponds to 'Disabled'. The remediation script directly modifies this registry value based on the provided argument ('Enabled' or 'Disabled') to align the system with the desired security posture.

Recommended State Rationale: 
- Basic: 'Enabled' is the minimum recommended state. It ensures that the primary function of logon hour restrictions is not bypassed, providing a baseline for time-based access control.
- Moderate: This state remains 'Enabled'. As this is a binary setting, there is no intermediate level of security; the policy is either enforced or it is not. 
- Strict: The strict recommendation is also 'Enabled'. This is the most secure configuration, as it guarantees that account time restrictions are upheld without exception, preventing session hijacking or unauthorized after-hours access.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the 'EnableForcedLogoff' DWORD value in the registry key 'HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters'. If the value data is 1, the script must return the string 'Enabled'. If the value data is 0 or the value/key does not exist, it must return 'Disabled'. The script must only output the resulting string and no other text or formatting.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument, which will be either 'Enabled' or 'Disabled'. If the argument is 'Enabled', the script must set the 'EnableForcedLogoff' DWORD value to 1 under the registry key 'HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters'. If the argument is 'Disabled', it must set the value to 0. The script must create the key or value if they do not exist. On successful modification, the script must return '$true'; otherwise, it must return '$false'.

