# Ensure 'Adjust memory quotas for a process' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE'

Necessity: The 'Adjust memory quotas for a process' user right determines which users can change the maximum memory available to a process. Granting this privilege to unauthorized accounts creates a significant risk for Denial of Service (DoS) attacks. A malicious actor could use this right to allocate excessive memory to a process, exhausting system resources and causing system-wide instability or crashes. Restricting this right to only essential system accounts is critical for maintaining system stability and security.

Auditing and Remediation: The audit script inspects the Local Security Policy to identify all accounts granted the 'SeIncreaseQuotaPrivilege'. The remediation script modifies this policy, overwriting the existing list of principals with the provided, correct set of accounts, thereby enforcing the principle of least privilege.

Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is the Windows default: 'Administrators, LOCAL SERVICE, NETWORK SERVICE'. This configuration is mandated by security benchmarks like CIS because it provides the necessary permissions for the system to operate correctly while minimizing risk. 'Administrators' require it for system management tasks. 'LOCAL SERVICE' and 'NETWORK SERVICE' are built-in accounts used by core Windows services that need this capability to function. Adding any other users or groups is strongly discouraged as it unnecessarily expands the attack surface, while removing any of the default accounts can cause system services to fail. Therefore, adhering to this specific configuration is the only recommended practice.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Administrators,LOCAL SERVICE,NETWORK SERVICE']` |
| **Moderate** | `['Administrators,LOCAL SERVICE,NETWORK SERVICE']` |
| **Strict** | `['Administrators,LOCAL SERVICE,NETWORK SERVICE']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the principals assigned the 'Adjust memory quotas for a process' (SeIncreaseQuotaPrivilege) user right. The script must resolve the Security Identifiers (SIDs) to their account names and output a single, comma-separated string of these names (e.g., 'Administrators,LOCAL SERVICE,NETWORK SERVICE'). The output must contain only this string value, without any headers or extra text.

## Remediation Script Working

PowerShell script that accepts a single, comma-separated string of user or group names as a direct command-line argument. The script must configure the 'Adjust memory quotas for a process' (SeIncreaseQuotaPrivilege) user right, assigning it to the specified principals. The script must use standard Windows methods, such as applying a security template with secedit.exe, to enforce the setting. It must return '$true' on success and '$false' on failure.

