# Ensure 'Disallow Autoplay for non-volume devices' is set to 'Enabled'

Necessity: The AutoPlay feature automatically runs commands or displays content when a device is connected. Non-volume devices, such as smartphones or cameras using Media Transfer Protocol (MTP), can be vectors for malware. If a malicious program is configured to run automatically upon connection, it can infect the system without user interaction. Disabling AutoPlay for these devices is a critical security measure to prevent the execution of unauthorized code from portable media.

Auditing and Remediation: The audit script inspects the Windows Registry to determine the current configuration of the 'Disallow Autoplay for non-volume devices' policy. The remediation script directly modifies this registry setting to enforce the desired state, either enabling the policy (disallowing AutoPlay) or disabling it.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict security levels is 'Enabled'. This is a binary security control; there is no intermediate state. The risk of malware propagation through portable devices is significant and applies to all environments. Therefore, enabling this policy is a foundational best practice recommended by security frameworks like the CIS Benchmarks to reduce the attack surface by eliminating a common malware infection vector.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry value 'NoAutoplayfornonVolume' at the path 'HKLM:\Software\Policies\Microsoft\Windows\Explorer'. The script must check if the value exists and its data is 1. If so, it should output the string 'Enabled'. In all other cases (value does not exist, is not 1, or the key is not found), it should output 'Disabled'. The script's output must consist solely of the resulting string.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument, which must be either 'Enabled' or 'Disabled'. If the argument is 'Enabled', the script must set the registry DWORD value 'NoAutoplayfornonVolume' at 'HKLM:\Software\Policies\Microsoft\Windows\Explorer' to 1. If the argument is 'Disabled', it must set the same value to 0. The script must create the registry key path if it does not already exist. It must return the boolean '$true' upon successful modification and '$false' on failure.

