# Ensure 'Network access: Do not allow storage of passwords and credentials for network authentication' is set to 'Enabled'

Necessity: This policy setting determines whether the Credential Manager saves passwords and credentials for later use when a user authenticates to a network resource. If this setting is disabled, an attacker who compromises the system could potentially steal these cached credentials and use them to move laterally across the network (e.g., via pass-the-hash attacks). Enabling this setting is a critical defense-in-depth measure to prevent credential theft and limit an attacker's ability to escalate privileges within the domain.

Auditing and Remediation: The audit script checks the value of the 'DisableDomainCreds' registry key to determine if the policy is active. The remediation script modifies this same registry key, setting its value to 1, which corresponds to the 'Enabled' state, thereby preventing the local storage of network authentication credentials.

Recommended State Rationale: 
- Basic: ['Enabled']. This is the universally recommended state according to security benchmarks like CIS. Enabling this policy provides a fundamental layer of protection against credential theft with minimal operational impact.
- Moderate: ['Enabled']. For a binary setting of this nature, 'Enabled' remains the only secure configuration. There is no middle ground; disabling it introduces a significant security risk.
- Strict: ['Enabled']. In a high-security environment, preventing any form of credential caching is non-negotiable. This setting must be 'Enabled' to adhere to the principle of least privilege and minimize the attack surface.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry value 'DisableDomainCreds' at 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'. The script must convert the output to 'Enabled' if the value is 1, and 'Disabled' if the value is 0 or does not exist. The script must return only the resulting string ('Enabled' or 'Disabled') and nothing else.

## Remediation Script Working

PowerShell script that accepts a single command-line argument, which will be either 'Enabled' or 'Disabled'. The script should set the registry value 'DisableDomainCreds' (REG_DWORD) at 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' to 1 if the argument is 'Enabled' and to 0 if it is 'Disabled'. The script must return $true on success and $false on failure.

