# Ensure 'Enforce password history' is set to '24 or more password(s)'

Necessity: Enforcing a password history prevents users from reusing old passwords. This is critical because if an attacker compromises a user's old password (e.g., from a previous data breach), they cannot use it to gain access again after the password has been changed. A low or non-existent password history allows users to cycle between a small set of familiar, easily guessable passwords, defeating the purpose of mandatory password changes and increasing vulnerability to credential stuffing attacks. Auditing and Remediation: The audit script reads the 'PasswordHistorySize' value directly from the local security policy database to determine the current setting. The remediation script uses system security command-line tools to modify this same policy value, enforcing the new, more secure setting. Recommended State Rationale: The Basic state of [24, 24] aligns with common security benchmarks (like CIS) and provides a strong defense against password reuse, ensuring that a password cannot be reused for at least two years in a typical 30-day change cycle. The Moderate state of [36, 36] offers enhanced protection for environments with higher security needs by significantly extending this reuse prohibition period. The Strict state of [50, 'upper bound'] is intended for high-security systems, making it practically impossible for a user to ever reuse a password, thereby providing the maximum defense against attacks leveraging compromised historical credentials.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[24, 'upper bound']` |
| **Moderate** | `[36, 'upper bound']` |
| **Strict** | `[50, 'upper bound']` |
| **Type** | `RANGE` |

## Audit Script Working

PowerShell script that queries the Local Security Policy for the 'PasswordHistorySize' setting. The script must parse the system's security database to find this value and print only the numerical value to standard output, with no additional text or labels.

## Remediation Script Working

PowerShell script that accepts a single positional integer argument representing the desired number of passwords to remember. The script must use this value to configure the 'PasswordHistorySize' setting in the Local Security Policy. The script must return the boolean value $true upon successful application of the setting and $false upon failure.

