# Ensure 'Network access: Allow anonymous SID/Name translation' is set to 'Disabled'

Necessity: Enabling 'Network access: Allow anonymous SID/Name translation' allows an unauthenticated user to discover account names by translating Security Identifiers (SIDs). For example, an attacker could translate the well-known SID for the 'Administrator' account (S-1-5-...-500) to find the actual name of the built-in administrator account. This information leakage provides attackers with valid usernames, which can be used in brute-force, password spraying, or social engineering attacks. Disabling this policy is a critical step in preventing unauthorized network reconnaissance. The risk of misconfiguration is the disclosure of sensitive account information to anonymous users, significantly increasing the attack surface. Auditing and Remediation: The audit script checks the value of the 'LsaLookupSids' registry key, which directly controls this policy. The remediation script modifies this registry key to '0', which corresponds to the 'Disabled' state, effectively preventing anonymous SID-to-name translation. Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is 'Disabled'. There is no legitimate reason in a secure environment to permit anonymous users to enumerate account names. This setting aligns with security best practices and benchmarks, such as the CIS Benchmarks. Because enabling it offers no operational benefit and introduces a significant security vulnerability, the only acceptable configuration is 'Disabled', regardless of the desired hardening level.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry value 'LsaLookupSids' at the path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'. The script should map the integer value (1 for Enabled, 0 for Disabled) to its corresponding string and output only the string 'Enabled' or 'Disabled'. If the value does not exist, it should default to 'Enabled'.

## Remediation Script Working

PowerShell script that accepts a single positional string argument: 'Enabled' or 'Disabled'. The script must convert this argument to its corresponding integer value (1 for Enabled, 0 for Disabled) and set the 'LsaLookupSids' REG_DWORD value at 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'. The script must return $true on success and $false on failure.

