# Ensure 'Network access: Do not allow anonymous enumeration of SAM accounts' is set to 'Enabled'

Necessity: This setting is crucial for preventing information disclosure. When disabled, an unauthenticated, anonymous attacker can enumerate all user account names on the system, including service and administrative accounts. This list of valid usernames provides the first piece of information needed for brute-force password attacks, password spraying, or targeted social engineering attempts. The risk of misconfiguration is high, as it grants attackers a significant advantage in the reconnaissance phase of an attack. Auditing and Remediation: The audit script checks the value of the 'RestrictAnonymousSAM' registry key to determine if anonymous enumeration is permitted. The remediation script modifies this registry key, setting its value to 1 to enable the restriction, thereby blocking unauthenticated users from listing account names. Recommended State Rationale: Basic: ['Enabled'] - This is the minimum acceptable security posture, aligning with security benchmarks like CIS. It directly mitigates the risk of account name reconnaissance. Moderate: ['Enabled'] - There is no intermediate state for this control; it is either secure (Enabled) or insecure (Disabled). The recommendation remains 'Enabled'. Strict: ['Enabled'] - For the highest level of security, this setting must be enabled. Any less secure configuration is unacceptable as it exposes critical system information to anonymous attackers.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the registry key 'HKLM:\System\CurrentControlSet\Control\Lsa' for the value 'RestrictAnonymousSAM'. The script should map the DWORD value (1 for Enabled, 0 for Disabled) to the corresponding string and return only that string ('Enabled' or 'Disabled'). If the value does not exist, it should be treated as 'Disabled'. Ensure no other text is output.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument, which must be either 'Enabled' or 'Disabled'. The script will configure the 'Network access: Do not allow anonymous enumeration of SAM accounts' setting by setting the registry DWORD value 'RestrictAnonymousSAM' at 'HKLM:\System\CurrentControlSet\Control\Lsa'. A parameter of 'Enabled' sets the value to 1, and 'Disabled' sets it to 0. The script must create the value if it does not exist. It must return `$true` on success and `$false` on failure.

