# Configure 'Interactive logon: Message title for users attempting to log on'

Necessity: Displaying a logon banner is a critical security control that serves as a legal notice to all users attempting to access the system. It establishes that access is limited to authorized personnel, informs users that their activities may be monitored, and eliminates any expectation of privacy. This is crucial for legal prosecution in cases of unauthorized access or misuse, as it demonstrates that the user was explicitly warned. Failure to display a banner can weaken an organization's legal position and fails to deter potential intruders.

Auditing and Remediation: The audit script verifies the current logon message title by reading the 'LegalNoticeCaption' value from the Windows Registry. The remediation script directly modifies this same registry value to set it to a compliant, organization-approved title.

Recommended State Rationale:
- Basic: 'Authorized Use Only' provides a fundamental, clear warning that meets minimum compliance requirements for establishing a system as private.
- Moderate: 'WARNING: Authorized Access Only' uses a stronger, more explicit prefix ('WARNING') to increase the prominence and legal gravity of the message, ensuring it is less likely to be overlooked by users.
- Strict: 'NOTICE: System Use and Monitoring Policy' employs formal, legalistic language to provide the strongest possible legal protection. It explicitly references a formal policy and monitoring, which is essential for enforcing acceptable use policies and for providing a solid foundation for disciplinary or legal action in corporate and government environments.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Authorized Use Only']` |
| **Moderate** | `['WARNING: Authorized Access Only']` |
| **Strict** | `['NOTICE: System Use and Monitoring Policy']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the registry value `LegalNoticeCaption` at the path `HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System`. The script must output only the string value of this registry key.

## Remediation Script Working

PowerShell script that sets the registry value `LegalNoticeCaption` (REG_SZ type) at `HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System`. The script must accept the desired message title as a single, positional command-line argument. It must return `$true` if the value is set successfully and `$false` otherwise.

