# Ensure 'Interactive logon: Prompt user to change password before expiration' is set to 'between 5 and 14 days'

Necessity: This setting determines how many days before a password expires that users are warned to change it. Properly configuring this policy is crucial for preventing unexpected account lockouts, which disrupt user productivity and increase help desk workload. Without a sufficient warning period, users may be forced to change their password under pressure, potentially leading to the selection of weaker passwords. The risk of not configuring this is operational disruption and degraded password hygiene. Auditing and Remediation: The audit script checks the current value of the 'PasswordExpiryWarning' registry key, which controls the password expiration prompt. The remediation script directly modifies this registry value to align it with the desired number of warning days. Recommended State Rationale: Basic [5, 14] aligns with common industry benchmarks like CIS, providing a flexible and ample warning period for most environments. Moderate [7, 10] tightens this window to between one and two weeks, ensuring the notification is more timely and less likely to be dismissed and forgotten. Strict [5, 7] is recommended for high-security environments, giving users one business week to act, which enforces prompt compliance without being overly disruptive.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[14, 5]` |
| **Moderate** | `[10, 5]` |
| **Strict** | `[5, 5]` |
| **Type** | `RANGE` |

## Audit Script Working

PowerShell script that queries the 'PasswordExpiryWarning' REG_DWORD value from the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon'. The script must output only the raw numerical value representing the number of days and nothing else.

## Remediation Script Working

PowerShell script that accepts a single numerical command-line argument. The script will set the 'PasswordExpiryWarning' REG_DWORD value at the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' to the provided argument. The script must return $true upon successful modification and $false if an error occurs.

