# Ensure 'Access this computer from the network' is set to 'Administrators, Remote Desktop Users'

The 'Access this computer from the network' policy setting determines which users and groups are permitted to connect to the computer over the network. Restricting this right is a critical security measure to reduce the system's attack surface. Overly permissive settings, such as granting access to 'Everyone' or 'Users', can allow unauthorized individuals to access shared resources, enumerate user accounts, and attempt to exploit network-facing services. The audit script verifies the current assignment for this user right by parsing the local security policy. The remediation script modifies the policy to enforce a specific list of authorized principals. The Basic state allows for standard remote access by both administrators and designated remote desktop users. The Moderate and Strict states align with security best practices (like CIS Benchmarks) by adhering to the principle of least privilege, limiting network access to only the 'Administrators' group. This is the most secure and practical configuration for systems that do not require remote access for non-administrative users, as it severely limits the potential for unauthorized network-based attacks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Administrators', 'Remote Desktop Users']` |
| **Moderate** | `['Administrators']` |
| **Strict** | `['Administrators']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the 'Access this computer from the network' user right (SeNetworkLogonRight). The script must use the 'secedit.exe /export' command to generate a security policy file, parse this file to find the principals assigned to 'SeNetworkLogonRight', and output only the raw, comma-separated string of SIDs (e.g., '*S-1-5-32-544,*S-1-5-32-555').

## Remediation Script Working

PowerShell script that sets the 'Access this computer from the network' user right (SeNetworkLogonRight). The script must accept a single, positional command-line argument containing a comma-separated string of user and group SIDs. The script will dynamically create a security template (.inf) file with the provided value and apply it using 'secedit.exe /configure'. The script must output '$true' on successful application and '$false' on failure.

