# Ensure 'Store passwords using reversible encryption' is set to 'Disabled'

Necessity: Storing passwords using reversible encryption is a critical security vulnerability. If enabled, it allows for the plaintext password to be recovered from the stored hash. An attacker who gains access to the account database can easily retrieve these passwords, leading to immediate account compromise, privilege escalation, and lateral movement throughout the network. This setting is a legacy feature required only for outdated authentication protocols like Challenge-Handshake Authentication Protocol (CHAP) and should be disabled in all modern environments. Auditing and Remediation: The audit script inspects the system's local security policy to determine if this dangerous setting is active. The remediation script directly modifies the policy using system tools to enforce the 'Disabled' state, thereby eliminating the risk of plaintext password recovery. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict is uniformly 'Disabled'. This is a binary security setting with no middle ground; enabling it introduces an unacceptable risk regardless of the environment's overall security posture. All major security benchmarks, including CIS and DISA STIGs, mandate that this setting must be disabled. There is no security benefit to enabling it, so the only correct configuration is 'Disabled' at all hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that exports the local security policy using `secedit`. The script must parse the output to find the value for 'ClearTextPassword'. It should output 'Enabled' if the value is 1, and 'Disabled' if the value is 0. The script must only return the resulting string with no extra text or labels.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument: 'Enabled' or 'Disabled'. The script must set the 'Store passwords using reversible encryption' policy to the provided state by mapping the input to its corresponding numeric value (1 for Enabled, 0 for Disabled), creating a temporary security policy (.inf) file, and applying it using `secedit /configure`. The script must return `$true` on success and `$false` on failure.

