# Ensure 'Disallow Autoplay for non-volume devices' is set to 'Enabled'

Necessity: The 'Disallow Autoplay for non-volume devices' setting is crucial for preventing malware execution from peripheral devices like cameras, smartphones, or other MTP/PTP devices. Attackers can create malicious devices that exploit the AutoPlay feature to automatically run code upon connection, leading to system compromise. Disabling this feature mitigates the risk of drive-by infections and attacks that rely on physical device insertion. Auditing and Remediation: The audit script checks the configuration by reading the 'NoAutoplayfornonVolume' registry value, which corresponds to this Group Policy setting. The remediation script directly modifies this registry value to enforce the desired state ('Enabled' or 'Disabled'). Recommended State Rationale: A state of 'Enabled' is recommended for all security levels (Basic, Moderate, and Strict). There is no security benefit to allowing AutoPlay on non-volume devices in a managed environment; the potential for unauthorized code execution presents a significant and unnecessary risk. Therefore, the only secure configuration is to have this policy enabled, regardless of the overall hardening level.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the registry value at 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer' for the key 'NoAutoplayfornonVolume'. The script must return 'Enabled' if the DWORD value is 1, and 'Disabled' if the value is 0 or does not exist. The output should only be the resulting string, with no additional text or formatting.

## Remediation Script Working

PowerShell script that accepts a single positional argument ('Enabled' or 'Disabled'). If the argument is 'Enabled', the script must set the registry DWORD value of 'NoAutoplayfornonVolume' at 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer' to 1. If 'Disabled', it must set the value to 0. The script must create the path if it does not exist. On success, it must return $true; on failure, it must return $false.

