# Ensure 'Allow camera and microphone access in Microsoft Defender Application Guard' is set to 'Disabled'

Necessity: Microsoft Defender Application Guard (MDAG) provides a hardware-isolated browsing environment to protect the host system from malware on untrusted websites. Allowing camera and microphone access within this isolated container creates a potential data exfiltration channel. A compromised website running inside MDAG could potentially access these peripherals to spy on the user or their environment, defeating a key purpose of the isolation. Disabling this feature ensures that even if an attacker compromises the browsing session, they cannot access sensitive hardware like the camera and microphone. Auditing and Remediation: The audit script checks the configuration by reading the 'AllowCameraMicrophoneRedirection' registry value, which governs this policy. A value of '0' or a non-existent value indicates it is disabled. The remediation script directly modifies this registry value to enforce the desired state, either enabling or disabling the feature. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict is '0' (Disabled). This follows the principle of least privilege. There is no secure scenario where enabling this by default is advisable. Access to sensitive peripherals from an untrusted, isolated environment should be denied unless there is an explicit and critical business need. Therefore, the baseline secure configuration is also the most strict one.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0']` |
| **Moderate** | `['0']` |
| **Strict** | `['0']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry value 'AllowCameraMicrophoneRedirection' at 'HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI'. The script must output '0' if the state is Disabled (value is 0 or does not exist) or '1' if the state is Enabled (value is 1). The output should contain only the numeric value and no other text.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument ('0' for Disabled, '1' for Enabled). The script must set the 'AllowCameraMicrophoneRedirection' registry value of type DWORD at 'HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI' to the provided argument. If the registry path does not exist, it must be created. The script must return $true on success and $false on failure.

