# Ensure 'Turn off Autoplay' is set to 'Enabled: All drives'

Necessity: The Autoplay feature automatically runs programs from media like USB drives and CDs upon insertion. This creates a significant security risk, as it is a primary vector for malware to spread automatically without user interaction. Disabling Autoplay for all drives is a critical defense-in-depth measure that prevents malware from executing immediately when a potentially infected device is connected. Misconfiguration leaves the system vulnerable to a wide range of autorun-based worms and trojans.

Auditing and Remediation: The audit script verifies the system's configuration by reading the `NoDriveTypeAutoRun` registry value, which directly corresponds to the 'Turn off Autoplay' Group Policy setting. The remediation script modifies this same registry value to enforce the desired state, either by setting it to disable Autoplay on all drives or by removing the value to restore the default behavior.

Recommended State Rationale: The Basic, Moderate, and Strict levels are all set to 'Enabled: All drives' because there is no secure middle ground for this setting. Any configuration that allows Autoplay on any drive type presents an unnecessary risk. Therefore, the universally recommended best practice, aligned with benchmarks like CIS, is to completely disable this feature across all drives to provide the most effective protection. This single configuration represents the minimum, moderate, and most stringent level of security for this control.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled: All drives']` |
| **Moderate** | `['Enabled: All drives']` |
| **Strict** | `['Enabled: All drives']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the state of the 'Turn off Autoplay' Group Policy. The script must check the registry key `HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer` for the DWORD value `NoDriveTypeAutoRun`. If the value exists and is set to `255` (0xFF), the script must return the string 'Enabled: All drives'. For any other value or if the value is not present, it should return 'Disabled'. The script must output only the resulting string.

## Remediation Script Working

PowerShell script that accepts a single string argument: 'Enabled: All drives' or 'Disabled'. If the argument is 'Enabled: All drives', the script must set the registry DWORD value `NoDriveTypeAutoRun` to `255` at `HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer`, creating the path if necessary. If the argument is 'Disabled', it must remove the `NoDriveTypeAutoRun` value. The script must return `$true` on successful modification or `$false` if it fails or receives an invalid argument.

