# Ensure 'Allow data persistence for Microsoft Defender Application Guard' is set to 'Disabled'

Necessity: Microsoft Defender Application Guard provides security by isolating untrusted sites and files in a virtualized container. Allowing data persistence enables data such as cookies, favorites, and passwords to be saved between Application Guard sessions. If this setting is enabled, malware that compromises a session could potentially save malicious data or artifacts that persist to subsequent sessions, creating a bridge for an attacker and undermining the isolation principle. Disabling data persistence ensures that each session starts in a clean, known-good state, maximizing protection.

Auditing and Remediation: The audit script checks the configuration by reading the 'VsmPersistency' registry value under 'HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI'. A value of '0' corresponds to 'Disabled', which is the secure state. The remediation script directly modifies this registry value to enforce the desired state, setting it to '0' to disable persistence.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict security levels is 'Disabled'. There is no security benefit to enabling this feature; doing so only introduces risk. Therefore, to adhere to the principle of least privilege and maintain the integrity of the Application Guard security boundary, data persistence must be disabled across all security hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry value 'VsmPersistency' at 'HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI'. The script should map the integer value to a string: '0' maps to 'Disabled', '1' maps to 'Enabled'. If the value does not exist, it should return 'Not Configured'. The script must only output the resulting string ('Disabled', 'Enabled', or 'Not Configured').

## Remediation Script Working

PowerShell script that accepts a single command-line argument: 'Enabled' or 'Disabled'. The script must create or set the DWORD registry value 'VsmPersistency' at 'HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI'. If the argument is 'Disabled', set the value to '0'. If the argument is 'Enabled', set the value to '1'. The script must return '$true' on success and '$false' on failure.

