# Ensure 'Network security: Minimum session security for NTLM SSP based (including secure RPC) servers' is set to 'Require NTLMv2 session security, Require 128-bit encryption'

Necessity: This policy setting enforces a minimum level of security for authentication sessions on servers. NTLMv1 is a legacy protocol with significant, well-known vulnerabilities, making it susceptible to relay attacks and credential cracking. Enforcing NTLMv2 session security ensures that clients use a much stronger challenge/response mechanism, mitigating these risks. Furthermore, requiring 128-bit encryption protects the session data itself from eavesdropping and man-in-the-middle attacks. Failure to enforce this minimum level leaves servers vulnerable to credential theft, session hijacking, and data compromise, especially in environments where Kerberos is not used.

Auditing and Remediation: The audit script checks the current configuration by reading the `NtlmMinServerSec` DWORD value from the registry. A value of `537395200` (`0x20080000`) indicates the correct configuration. The remediation script modifies this registry value to enforce the required security level, ensuring that both NTLMv2 and 128-bit encryption are mandatory for server sessions.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is `537395200`. This value corresponds to enabling both 'Require NTLMv2 session security' and 'Require 128-bit encryption'. This is considered the highest security setting for this policy and is a baseline requirement in modern security frameworks (e.g., CIS Benchmarks). There is no secure intermediate state; any configuration less than this standard exposes the system to unacceptable risks associated with weak authentication protocols. Therefore, this single, stringent value is recommended for all security hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['537395200']` |
| **Moderate** | `['537395200']` |
| **Strict** | `['537395200']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the `NtlmMinServerSec` DWORD value from the registry key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0`. The script must output only the raw value of the setting.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument for the desired DWORD value. The script should set the `NtlmMinServerSec` value (as a DWORD type) within the registry key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0` to the provided argument. The script must return `$true` on success and `$false` on failure.

