# Ensure 'Turn off Autoplay' is set to 'Enabled: All drives'

Necessity: The AutoPlay feature automatically executes commands or opens programs from removable media like USB drives when they are inserted into a computer. This functionality creates a significant security vulnerability, as it is a primary vector for malware (such as worms and Trojans) to propagate automatically without user interaction. Disabling AutoPlay for all drives is a critical defense-in-depth measure to prevent initial system compromise from infected physical media.

Auditing and Remediation: The audit script checks the registry key 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' for the 'NoDriveTypeAutoRun' value. A value of '255' (Hexadecimal 0xFF) confirms that AutoPlay is disabled for all drive types. The remediation script directly manipulates this registry value. It sets the value to '255' to enforce the policy or removes it to revert to the default (disabled) state.

Recommended State Rationale: 
- Basic: ['Enabled: All drives']. This is the minimum acceptable security baseline, recommended by CIS Benchmarks and other security frameworks. It closes the most common and high-risk attack vector associated with this feature.
- Moderate: ['Enabled: All drives']. There is no effective intermediate state. Partially disabling AutoPlay (e.g., only for CD-ROMs) still leaves the system vulnerable to ubiquitous devices like USB drives. Therefore, the moderate recommendation is identical to the basic, enforcing a complete lockdown.
- Strict: ['Enabled: All drives']. The most secure configuration is the complete and universal disabling of AutoPlay. There is no stricter setting for this control. This state provides the maximum possible protection against this specific threat vector.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled: All drives']` |
| **Moderate** | `['Enabled: All drives']` |
| **Strict** | `['Enabled: All drives']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to audit the 'Turn off Autoplay' setting. The script must query the registry value 'NoDriveTypeAutoRun' at the path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer'. If the value data is '255' (0xFF), the script must return the string 'Enabled: All drives'. If the value does not exist or is not '255', it should return 'Disabled'. The script must only output the resulting string and nothing else.

## Remediation Script Working

PowerShell script that accepts a single string argument to configure the 'Turn off Autoplay' policy. If the argument is 'Enabled: All drives', the script must create and set the registry DWORD value 'NoDriveTypeAutoRun' at 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' to '255' (0xFF). If the argument is 'Disabled', it must remove the 'NoDriveTypeAutoRun' value. The script must return '$true' on success and '$false' on failure.

