# Ensure 'Interactive logon: Machine account lockout threshold' is set to '10 or fewer invalid logon attempts, but not 0'

Necessity: This setting determines the number of failed logon attempts that cause a machine account to be locked out. It is a critical defense against brute-force attacks targeting computer accounts. Attackers who compromise a machine account can use it for lateral movement within a network. Disabling this feature (setting it to 0) or setting it to a high number leaves the environment vulnerable to automated password-guessing attacks. Auditing and Remediation: The audit script reads the specific registry value that stores the lockout threshold to determine the current configuration. The remediation script directly modifies this registry value to enforce the desired lockout policy. Recommended State Rationale: The recommendation is that this value be between 1 and 10. Basic: A value of '10' is the maximum recommended threshold by security benchmarks (like CIS) and provides a baseline level of protection against brute-force attacks. Moderate: A threshold of '5' significantly reduces the time and attempts an attacker has, offering a stronger security posture while still allowing for occasional legitimate failures without causing excessive operational friction. Strict: A threshold of '3' provides the most robust protection by severely limiting an attacker's ability to guess passwords. This is recommended for high-security environments where the risk of targeted attacks is greater and administrative processes are mature enough to handle potential accidental lockouts.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[10, 1]` |
| **Moderate** | `[5, 1]` |
| **Strict** | `[3, 1]` |
| **Type** | `RANGE` |

## Audit Script Working

PowerShell script that queries the registry value 'MachineAccountLockoutThreshold' at 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa'. The script must output only the numerical value of this setting. If the value is not set, the script should output '0'.

## Remediation Script Working

PowerShell script that accepts a single numerical command-line argument. The script must set the registry value 'MachineAccountLockoutThreshold' of type 'REG_DWORD' at 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa' to the provided argument. The script must return '$true' if the operation is successful and '$false' if it fails.

