# Ensure 'Access this computer from the network' is set to 'Administrators, Remote Desktop Users'

Necessity: The 'Access this computer from the network' user right determines which users and groups are permitted to establish network connections to the machine. This includes access to shared files and printers, as well as other network services like Remote Desktop. Overly permissive settings, such as granting this right to 'Everyone' or 'Users', significantly increase the system's attack surface by allowing any network user to attempt authentication, probe for vulnerabilities, or engage in lateral movement activities if they have compromised a standard user account. Restricting this right is a fundamental step in securing a system from unauthorized network access.

Auditing and Remediation: The audit script inspects the local security policy database to identify all principals currently granted the 'SeNetworkLogonRight' privilege. The remediation script modifies this policy by overwriting the existing list of principals with a new, specified list, thereby enforcing the desired access control configuration.

Recommended State Rationale:
- Basic: ['Administrators,Remote Desktop Users'] is a suitable baseline for systems designed for remote access by both administrators and designated standard users, such as terminal servers or remote workstations. It grants necessary access while avoiding overly broad groups.
- Moderate: ['Administrators'] is a more secure configuration appropriate for most servers and workstations. It adheres to the principle of least privilege by ensuring only administrative accounts can initiate network logons, which is sufficient for management purposes and reduces the risk associated with compromised standard user accounts.
- Strict: ['Administrators'] is also the strict recommendation. While assigning the right to an empty group is technically possible, removing 'Administrators' can break critical functions, including Group Policy application and remote administration, potentially rendering the system unmanageable. Therefore, for operational systems, limiting this right to only the 'Administrators' group is the most secure and functional configuration.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Administrators,Remote Desktop Users']` |
| **Moderate** | `['Administrators']` |
| **Strict** | `['Administrators']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to retrieve the list of accounts assigned the 'Access this computer from the network' user right (SeNetworkLogonRight). The script must export the local security policy, parse the result, and output a single comma-separated string of the account names (e.g., 'Administrators,Remote Desktop Users'), with no extra text or labels.

## Remediation Script Working

PowerShell script that sets the 'Access this computer from the network' user right. The script must accept a single, positional command-line argument: a comma-separated string of account names (e.g., 'Administrators,Remote Desktop Users'). The script must convert the names to SIDs, apply the new configuration, and output '$true' on success or '$false' on failure.

