# Ensure 'Interactive logon: Don't display last signed in' is set to 'Enabled'

Necessity: This setting is crucial for preventing information disclosure. Displaying the last signed-in user's name on the logon screen provides an attacker with a valid username, which is half of the required credentials for a successful login. This simplifies brute-force and password-spraying attacks. By enabling this policy, the system forces any potential attacker to possess both the username and the password, significantly increasing the difficulty of unauthorized access. It is a fundamental hardening step recommended by security frameworks like the CIS Benchmarks.\n\nAuditing and Remediation: The audit script checks the registry key 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' for the value 'DontDisplayLastUserName'. A data of '1' corresponds to 'Enabled'. The remediation script directly modifies this registry value, setting it to '1' to enable the policy or '0' to disable it, thereby controlling the logon screen behavior.\n\nRecommended State Rationale: Basic, Moderate, and Strict states are all set to 'Enabled'. This is a binary security control with no valid reason for a less secure configuration in a hardened environment. The risk of exposing a valid username far outweighs any minor convenience of displaying it. Therefore, the most secure and universally recommended state is 'Enabled' across all levels of hardening.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry value 'DontDisplayLastUserName' at 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. The script should output 'Enabled' if the value data is '1', and 'Disabled' if the value data is '0' or if the value does not exist. The script must return only the string 'Enabled' or 'Disabled'.

## Remediation Script Working

PowerShell script that accepts a single positional string argument: 'Enabled' or 'Disabled'. The script will configure the 'Interactive logon: Don't display last signed in' setting by modifying the 'DontDisplayLastUserName' registry value at 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. If the argument is 'Enabled', set the value to '1' (DWORD). If 'Disabled', set it to '0' (DWORD). The script must return '$true' on success and '$false' on failure.

