# Ensure 'Network security: Do not store LAN Manager hash value on next password change' is set to 'Enabled'

The LAN Manager (LM) hash is a legacy, weak cryptographic representation of passwords that is highly susceptible to brute-force attacks. Storing these hashes creates a significant security vulnerability. An attacker who gains access to the password hash database can easily crack LM hashes in seconds, compromising user credentials. Disabling the storage of LM hashes mitigates this risk by ensuring only the stronger NTLM hashes are stored. The audit script checks the corresponding registry key to determine if the system is configured to prevent LM hash storage. The remediation script modifies this registry setting to enable the policy, instructing the system to no longer generate or store LM hashes upon the next password change. The recommended state for all security levels (Basic, Moderate, and Strict) is 'Enabled'. This is a binary setting with no middle ground; disabling LM hash storage is a foundational security measure and is recommended by all major security benchmarks. Leaving it disabled is considered a critical misconfiguration.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the registry value 'NoLMHash' at 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'. The script should output '1' if the setting is Enabled (value is 1), and '0' if it is Disabled (value is 0 or does not exist). The output must only be the numerical value with no extra text or labels.

## Remediation Script Working

PowerShell script that accepts a single command-line argument representing the desired state (e.g., 'Enabled'). The script must set the registry DWORD value 'NoLMHash' at 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' to '1' if the input is 'Enabled'. The script must create the value if it doesn't exist. It must return $true on success and $false on failure.

