# Ensure 'Network security: Minimum session security for NTLM SSP based (including secure RPC) clients' is set to 'Require NTLMv2 session security, Require 128-bit encryption'

Necessity: This policy setting determines the minimum security standards for client devices using the NTLM Security Support Provider (SSP). NTLM is an older authentication protocol with known vulnerabilities, particularly in its NTLMv1 and LAN Manager (LM) versions, which are susceptible to credential theft via relay and pass-the-hash attacks. Enforcing a minimum security level mandates the use of stronger protocols like NTLMv2 and requires encryption, which protects authentication traffic and session data from being intercepted and compromised on the network. Misconfiguration leaves clients vulnerable to man-in-the-middle attacks, credential harvesting, and session hijacking.

Auditing and Remediation: The audit script checks the current security level by reading the 'NtlmMinClientSec' DWORD value from the registry. The remediation script modifies this same registry value to enforce a new, more secure minimum standard for NTLM sessions.

Recommended State Rationale:
- Basic: The value '524288' corresponds to 'Require NTLMv2 session security'. This is the minimum acceptable baseline as it prohibits the use of the highly insecure NTLMv1 and LM protocols, significantly reducing the risk of relay attacks.
- Moderate: The value '537395200' corresponds to 'Require NTLMv2 session security' and 'Require 128-bit encryption'. This state, aligned with CIS Benchmarks, builds upon the basic level by also mandating strong encryption for the session data. This ensures both the authentication handshake and subsequent communications are confidential and protected from eavesdropping.
- Strict: This level uses the same value as Moderate, '537395200', as it represents the highest level of security available for this specific setting. It provides maximum protection for NTLM-based communications by enforcing both the strongest NTLM protocol version and robust session encryption.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['524288']` |
| **Moderate** | `['537395200']` |
| **Strict** | `['537395200']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry value 'NtlmMinClientSec' at the path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0'. The script must output only the numerical data of this registry value. If the value does not exist or is not set, the script should return '0'.

## Remediation Script Working

PowerShell script that accepts a single numerical command-line argument. The script must set the registry value 'NtlmMinClientSec' of type 'DWORD' at 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0' to the value provided by the argument. The script must return '$true' if the operation is successful and '$false' otherwise.

