# Ensure 'Enforce password history' is set to '24 or more password(s)'

The 'Enforce password history' policy determines the number of unique new passwords that must be associated with a user account before an old password can be reused. Its necessity stems from the need to prevent password reuse attacks. If an attacker compromises a user's password, a strong password history policy ensures that even after a mandatory password change, the user cannot revert to the compromised password, thereby mitigating the risk of continued unauthorized access. The audit script inspects the local security database to retrieve the current history size. The remediation script modifies this same database to enforce a new, more secure value. The Basic state of 24 is a common industry baseline (e.g., CIS Benchmark) that prevents reuse for a significant period (e.g., two years with monthly changes). The Moderate state of 30 increases this protection window, making it harder for users to cycle back to memorable passwords. The Strict state of 50 or more effectively discourages password reuse altogether, forcing the creation of novel passwords and providing the strongest defense against attacks leveraging historical or breached credentials.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[24, 'upper bound']` |
| **Moderate** | `[36, 'upper bound']` |
| **Strict** | `[50, 'upper bound']` |
| **Type** | `RANGE` |

## Audit Script Working

PowerShell script that queries the local security policy for the 'Enforce password history' setting (PasswordHistorySize). The script must be configured to output only the numerical value of the current setting, with no additional text or formatting.

## Remediation Script Working

PowerShell script that sets the 'Enforce password history' (PasswordHistorySize) value. The script must accept the desired numerical value as a single, positional command-line argument. It should apply this value to the local security policy and output '$true' upon successful application or '$false' if the operation fails.

