# Ensure 'Set the default behaviour for AutoRun' is set to 'Enabled: Do not execute any autorun commands'

Necessity: The AutoRun feature in Windows allows for the automatic execution of commands when removable media (like USB drives) is inserted. This presents a significant security risk as it has been a primary vector for malware and viruses to spread automatically without user intervention. By disabling the execution of autorun commands, the system is protected against this common attack vector, forcing the user to manually initiate any action, thereby providing an opportunity to vet the media's contents. Risk of Misconfiguration: If this policy is not enabled, the system is vulnerable to malware that propagates through removable devices, which could lead to system compromise, data theft, or ransomware infection. Auditing and Remediation: The audit script checks the registry value at 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoAutorun'. A value of '255' (0xFF) disables AutoRun on all drive types. The remediation script ensures this registry value is set correctly, thereby enforcing the security policy across the system. Recommended State Rationale: The Basic, Moderate, and Strict levels all recommend the same state because disabling autorun commands is a fundamental security best practice. There is no acceptable level of risk associated with leaving this feature enabled. This recommendation aligns with guidance from major security frameworks like the CIS Benchmarks and DISA STIGs, which universally advise disabling this functionality to mitigate a critical threat.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled: Do not execute any autorun commands']` |
| **Moderate** | `['Enabled: Do not execute any autorun commands']` |
| **Strict** | `['Enabled: Do not execute any autorun commands']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to check the registry for the 'Set the default behaviour for AutoRun' policy. The script must query the DWORD value 'NoAutorun' at the path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer'. If the value is present and set to '255' (0xFF), the script shall return the string 'Enabled: Do not execute any autorun commands'. In all other cases, including if the key or value does not exist, it must return 'Disabled'. The script must not output any other text or formatting.

## Remediation Script Working

PowerShell script that accepts a single positional string argument. If the argument is 'Enabled: Do not execute any autorun commands', the script must create the registry path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' if it doesn't exist, and then set the DWORD value 'NoAutorun' to '255'. The script must return '$true' upon successful modification or if the setting is already correct. It must return '$false' if the operation fails.

