# Ensure 'Allow camera and microphone access in Microsoft Defender Application Guard' is set to 'Disabled'

Necessity: Microsoft Defender Application Guard (MDAG) provides a hardware-isolated browsing environment to protect the host OS from malicious websites. Allowing camera and microphone access within this isolated container creates a potential data exfiltration channel. If a malicious site compromises the browser inside the MDAG session, it could potentially spy on the user by capturing audio and video. Disabling this access enforces the principle of least privilege, ensuring that isolated sessions cannot access sensitive peripherals, thereby mitigating the risk of corporate espionage and privacy breaches.

Auditing and Remediation: The audit script queries the specific registry key (`HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI\VsmDisableCameraMicrophone`) that controls this Group Policy setting. A value of `1` corresponds to 'Disabled', while a value of `0` or the absence of the key corresponds to 'Enabled' (the default, insecure state). The remediation script directly writes the appropriate DWORD value (`1` for Disabled, `0` for Enabled) to this registry location to enforce the desired policy.

Recommended State Rationale: 
- Basic: ['Disabled']. This is the fundamental recommendation. Any organization using MDAG should block peripheral access by default to prevent potential data leakage from isolated browsing sessions.
- Moderate: ['Disabled']. There is no effective intermediate configuration for this setting; access is either permitted or denied. Therefore, the moderate recommendation remains 'Disabled' to maintain a secure posture.
- Strict: ['Disabled']. In a high-security environment, this setting is non-negotiable. It guarantees that even if an attacker finds a vulnerability within the sandboxed browser, they are prevented from accessing the system's camera and microphone, closing a significant vector for surveillance and data theft.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that audits the 'Allow camera and microphone access in Microsoft Defender Application Guard' setting. The script must check the registry value `VsmDisableCameraMicrophone` at `HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI`. If the value data is `1`, the script must return 'Disabled'. If the value data is `0` or if the value or key does not exist, it must return 'Enabled'. The script's output must be limited to only the state string ('Enabled' or 'Disabled').

## Remediation Script Working

PowerShell script that accepts a single positional argument, which must be either 'Enabled' or 'Disabled'. The script will configure the 'Allow camera and microphone access in Microsoft Defender Application Guard' setting. If the argument is 'Disabled', it must set the DWORD value `VsmDisableCameraMicrophone` to `1` at `HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI`. If the argument is 'Enabled', it must set the same value to `0`. The script must create the registry key if it does not exist. It must return `$true` on successful modification and `$false` on failure.

