# Ensure 'Allow data persistence for Microsoft Defender Application Guard' is set to 'Disabled'

Necessity: Microsoft Defender Application Guard (MDAG) provides enhanced security by isolating untrusted websites and files in a lightweight virtualized container. Allowing data persistence means that data created within an MDAG session, such as cookies, favorites, and saved passwords, is saved and restored in subsequent sessions. Disabling persistence is critical because if the isolated container is compromised, any persistent data could be exfiltrated or manipulated by an attacker. By disabling this feature, each MDAG session starts as a clean, ephemeral instance, ensuring that any potential malware or compromise is completely wiped out when the session ends, which aligns with the principle of a non-persistent, secure browsing environment.

Auditing and Remediation: The audit script checks the system's registry to determine if data persistence for MDAG is enabled or disabled. The remediation script directly modifies this registry key to enforce the desired state, either allowing ('Enabled') or disallowing ('Disabled') data persistence based on the provided argument.

Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is 'Disabled'. This is a binary security control where the only secure option is to prevent data from persisting from untrusted environments. Enabling this feature would create a channel for potential threats to survive across sessions, fundamentally undermining the isolation and security benefits that Application Guard is designed to provide. Therefore, to maintain the integrity of the feature, data persistence must be disabled.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the registry value at 'HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI\AllowDataPersistence'. If the value data is '1', the script must return 'Enabled'. If the value data is '0' or the value/key does not exist, it must return 'Disabled'. The script should only return the string value of the current state and nothing else.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument which can be either 'Enabled' or 'Disabled'. The script must configure the 'Allow data persistence for Microsoft Defender Application Guard' setting by setting the 'REG_DWORD' value of 'AllowDataPersistence' at 'HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI'. A desired state of 'Enabled' corresponds to a value of '1', and 'Disabled' corresponds to a value of '0'. The script must create the registry key if it does not exist. It must return '$true' upon successful application of the setting and '$false' on failure.

