# Ensure 'Network access: Let Everyone permissions apply to anonymous users' is set to 'Disabled'

Necessity: This setting determines whether anonymous users are included in the 'Everyone' security group. Enabling it allows unauthenticated users to access any network resource (like shared files, printers, or registry keys) that grants permissions to the 'Everyone' group. This creates a significant security vulnerability, as it can lead to unauthorized information disclosure, enumeration of account names and shares, and can provide an initial foothold for attackers. Disabling this setting enforces that only authenticated users are part of the 'Everyone' group, adhering to the principle of least privilege.

Auditing and Remediation: The audit script checks the configuration by querying the 'everyoneincludesanonymous' registry value, which directly controls this policy. The remediation script modifies this same registry value to align the system's configuration with the desired state, effectively enabling or disabling the inclusion of anonymous users in the 'Everyone' group.

Recommended State Rationale:
- Basic: ['Disabled'] - This is the universally recommended security baseline from sources like Microsoft and CIS Benchmarks. Disabling this setting is a fundamental step in securing a Windows system from unauthorized network access.
- Moderate: ['Disabled'] - For a moderately hardened system, there is no justification for enabling this setting. The risk of information exposure far outweighs any potential, rare use case. The secure state remains 'Disabled'.
- Strict: ['Disabled'] - In a strict security environment, allowing anonymous access is unacceptable. This setting must be 'Disabled' to ensure the highest level of security and prevent any possibility of unauthenticated enumeration or access to system resources.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the security policy setting. The script should read the DWORD value of 'everyoneincludesanonymous' at the registry path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'. If the value is 0 or does not exist, the script must output only the string 'Disabled'. If the value is 1, it must output only the string 'Enabled'. No other text should be returned.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument which must be either 'Enabled' or 'Disabled'. The script will set the DWORD value for 'everyoneincludesanonymous' at the registry path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'. It should set the value to 1 if the argument is 'Enabled' and 0 if 'Disabled'. The script must return the boolean value $true upon successful modification and $false if it fails or receives an invalid argument.

