# Ensure 'Network access: Do not allow storage of passwords and credentials for network authentication' is set to 'Enabled'

Necessity: This setting is critical for preventing credential theft. When enabled, it stops the system from caching passwords and credentials used for network authentication. If a system is compromised, attackers often attempt to extract cached credentials to move laterally across the network. By not storing these credentials, this setting significantly reduces the attack surface and mitigates the risk of pass-the-hash and other credential replay attacks. Misconfiguration leaves sensitive credentials vulnerable on the local machine.

Auditing and Remediation: The audit script checks the value of the 'DisableDomainCreds' registry key. The remediation script directly modifies this key to either enable or disable the policy based on the provided input.

Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is 'Enabled'. This is a binary security control with no middle ground; it is either securely configured or it is not. Enabling this policy is a fundamental security best practice recommended by frameworks like CIS Benchmarks and DISA STIGs. The risk of credential exposure by leaving this setting disabled is high, making 'Enabled' the only acceptable configuration for any secure environment.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry key 'HKLM:\System\CurrentControlSet\Control\Lsa' for the 'DisableDomainCreds' DWORD value. The script must return 'Enabled' if the value is 1, and 'Disabled' if the value is 0 or does not exist. The output must contain only the string 'Enabled' or 'Disabled' with no extra text.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument: 'Enabled' or 'Disabled'. The script must configure the 'DisableDomainCreds' DWORD value in 'HKLM:\System\CurrentControlSet\Control\Lsa', setting it to 1 for 'Enabled' and 0 for 'Disabled'. The script must return '$true' upon successful modification and '$false' on failure.

