# Ensure 'Prevent enabling lock screen camera' is set to 'Enabled'

Necessity: Enabling this policy prevents users from activating the camera on the lock screen. This is a critical privacy and security measure that reduces the system's attack surface before a user has authenticated. It mitigates the risk of unauthorized camera access, which could be used for reconnaissance, capturing sensitive information in the environment, or attempting to bypass facial recognition authentication. Disabling this functionality adheres to the principle of least privilege by removing a non-essential feature from a sensitive, pre-login state.

Auditing and Remediation: The audit script checks the configuration by reading the 'NoLockScreenCamera' registry value, which corresponds to this Group Policy setting. A value of '1' indicates the policy is enabled. The remediation script directly modifies this registry value to enforce the desired state, either enabling the restriction by setting the value to '1' or disabling it by setting it to '0'.

Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is 'Enabled'. This is a binary security control with a clear benefit and minimal operational impact. There is no less-secure state that is acceptable from a security standpoint. Therefore, enabling this policy is the baseline recommendation and remains the most secure configuration for any environment concerned with user privacy and system security.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the registry value 'NoLockScreenCamera' at 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization'. If the value is present and set to '1', the script must return 'Enabled'. Otherwise, it must return 'Disabled'. The output must only be the string 'Enabled' or 'Disabled' with no extra text or formatting.

## Remediation Script Working

PowerShell script that accepts a single positional argument, which will be either 'Enabled' or 'Disabled'. If the argument is 'Enabled', the script must set the registry DWORD value 'NoLockScreenCamera' at 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization' to '1'. If the argument is 'Disabled', it must set the same value to '0'. The script must ensure the registry path exists. On successful modification, the script must return $true; otherwise, it must return $false.

