# Ensure 'Prevent enabling lock screen camera' is set to 'Enabled'

The 'Prevent enabling lock screen camera' policy is a critical security control for protecting user privacy and preventing unauthorized surveillance. By enabling this policy, administrators can ensure that the device's camera cannot be activated from the lock screen, even if certain applications have permissions to do so. This mitigates the risk of an unauthorized individual accessing the camera on a locked but powered-on machine, potentially capturing sensitive information or exploiting camera-related vulnerabilities without first authenticating. Misconfiguration leaves a potential physical access vulnerability open. The audit script verifies the current configuration by checking the specific registry key that governs this policy. The remediation script directly modifies this registry key to enforce the desired state. For all security levels (Basic, Moderate, and Strict), the recommended state is 'Enabled'. There is no less secure, acceptable alternative for this setting; either the camera is secured at the lock screen, or it is not. Enforcing this policy aligns with the principle of least functionality, ensuring that only necessary components are accessible in a pre-authentication state, which is a fundamental practice in securing endpoints.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the registry value 'NoLockScreenCamera' at 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization'. The script should check if the value data is '1'. If it is, the script must return the string 'Enabled'. Otherwise, it must return 'Disabled'. The output must only contain the current state string and no other text or labels.

## Remediation Script Working

PowerShell script that accepts a single positional string argument: 'Enabled' or 'Disabled'. The script will configure the 'Prevent enabling lock screen camera' policy. If the argument is 'Enabled', it must set the REG_DWORD value 'NoLockScreenCamera' at 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization' to '1'. If 'Disabled', it must set it to '0'. The script must create the registry path if it does not exist. It must return '$true' on success and '$false' on failure.

