# Ensure 'Network security: Minimum session security for NTLM SSP based (including secure RPC) servers' is set to 'Require NTLMv2 session security, Require 128-bit encryption'

Necessity: This policy setting determines the minimum session security standards for connections to NTLM SSP-based servers. Older NTLM protocols, such as NTLMv1, are vulnerable to various attacks, including replay and man-in-the-middle attacks, which can lead to credential theft and session hijacking. Enforcing NTLMv2 and 128-bit encryption significantly strengthens authentication and ensures the confidentiality and integrity of data in transit. Misconfiguration leaves servers exposed to credential compromise and data eavesdropping, particularly in environments where Kerberos is not universally used.

Auditing and Remediation: The audit script verifies the current configuration by reading the 'NtlmMinServerSec' registry value, which is a bitmask representing the security options. A value of '537395200' (0x20080000) corresponds to the required state. The remediation script directly modifies this registry value to enforce the specified combination of NTLMv2 session security and 128-bit encryption, aligning the system with security best practices.

Recommended State Rationale: 
- Basic: A value of '537395200' ('Require NTLMv2 session security, Require 128-bit encryption') is the minimum recommended state. This level is mandated by security benchmarks like CIS to protect against modern threats targeting legacy authentication protocols.
- Moderate: The moderate state is the same as the basic state because this represents the most secure available configuration for this specific NTLM setting. There is no intermediate step that provides meaningful security benefits without reaching this level.
- Strict: The strict recommendation is also '537395200', as this setting enforces the highest level of security available for NTLM session protection. Moving beyond this involves transitioning away from NTLM entirely in favor of Kerberos, which is a broader architectural change outside the scope of this single policy.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['537395200']` |
| **Moderate** | `['537395200']` |
| **Strict** | `['537395200']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the registry value at 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0' for the property 'NtlmMinServerSec'. The script must output only the raw numerical value. If the value does not exist, the script should output nothing.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument. The script must set the DWORD registry value 'NtlmMinServerSec' at 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0' to the value provided in the argument. It must return '$true' on success and '$false' on failure.

