# Ensure 'Access Credential Manager as a trusted caller' is set to 'No One'

The 'Access Credential Manager as a trusted caller' privilege (SeTrustedCredManAccessPrivilege) allows an application to access a user's stored credentials (like passwords and certificates) programmatically without user consent. This is an extremely high-risk privilege. If a malicious actor compromises an account or process with this right, they could exfiltrate all stored credentials, leading to widespread system and network compromise. The audit script verifies which, if any, accounts are granted this sensitive right by inspecting the local security policy. The remediation script modifies this policy to ensure no accounts are assigned the privilege, effectively setting it to 'No One'. All recommended states (Basic, Moderate, and Strict) are set to 'No One' because there is no secure baseline other than complete restriction. Any deviation from this standard represents a significant security risk and should only be configured for specific, highly-vetted applications after a thorough security assessment. Standard security benchmarks, including CIS, mandate this setting be empty.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['No One']` |
| **Moderate** | `['No One']` |
| **Strict** | `['No One']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that audits the 'Access Credential Manager as a trusted caller' User Rights Assignment. The script must query the local security policy for the 'SeTrustedCredManAccessPrivilege' setting. It should return a comma-separated string of the assigned principals (SIDs or account names). If no principals are assigned, which corresponds to the 'No One' state, the script must return the string 'No One'. The output must contain only this value, with no additional text or formatting.

## Remediation Script Working

PowerShell script that configures the 'Access Credential Manager as a trusted caller' User Rights Assignment. The script must accept a single command-line argument representing the desired state. To set the policy to 'No One', the script should be run with the argument 'No One' or an empty string. The script must use system tools like `secedit.exe` to create and apply a security policy template that configures the 'SeTrustedCredManAccessPrivilege' setting accordingly, removing all assigned principals. The script must return `$true` on success or `$false` on failure.

