# Ensure 'Minimum password age' is set to '1 day'

Necessity: The 'Minimum password age' policy determines the period of time (in days) that a password must be used before a user can change it. Setting this policy to a value greater than zero is crucial to prevent users from circumventing password history controls. If a user is forced to change their password, a minimum age of at least one day prevents them from immediately changing it several times in a row to revert back to their original, familiar password. The primary risk of misconfiguration (setting it to 0) is the nullification of the 'Enforce password history' policy, as users can cycle through passwords instantly.

Auditing and Remediation: The audit script inspects the system's security database to retrieve the current numeric value for the 'MinimumPasswordAge' setting. The remediation script directly modifies this setting in the local security policy by creating and applying a security template with the specified value.

Recommended State Rationale: A value of 1 day is the universally accepted best practice and is recommended by security frameworks such as the CIS Benchmarks. 
- Basic: [1, 1] - This state establishes the minimum effective control to prevent immediate password cycling.
- Moderate: [1, 1] - This aligns with the industry standard, providing the necessary security without introducing usability issues.
- Strict: [1, 1] - Increasing the value beyond one day offers no significant additional security benefits and can negatively impact user experience, for example, by preventing a user from changing a temporary password assigned by a help desk on the same day. Therefore, 1 day is considered the optimal and most secure practical configuration.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[1, 1]` |
| **Moderate** | `[1, 1]` |
| **Strict** | `[1, 1]` |
| **Type** | `RANGE` |

## Audit Script Working

PowerShell script that queries the Local Security Policy for the 'Minimum password age' setting. The script must parse the configuration to find the value for 'MinimumPasswordAge' and return only the numeric value representing the number of days.

## Remediation Script Working

PowerShell script that accepts a single integer as a positional command-line argument, which represents the desired 'Minimum password age' in days. The script must use this value to configure the local security policy, applying the change, and must return the boolean value $true on success or $false on failure.

