# Configure 'Interactive logon: Message title for users attempting to log on'

Necessity: Displaying a logon banner is a critical security control that serves as a legal deterrent. It informs all users that the system is intended for authorized use only and that their activities may be monitored. In the event of unauthorized access or malicious activity, the presence of this banner strengthens an organization's legal position for prosecution by eliminating any claim of ignorance or implied consent. Misconfiguration, such as having no banner, may weaken the ability to take legal action against intruders.

Auditing and Remediation: The audit script verifies the current configuration by directly reading the 'LegalNoticeCaption' value from the Windows Registry, which stores this local security policy setting. The remediation script directly modifies this same registry value, allowing an administrator to set or change the logon message title programmatically.

Recommended State Rationale: 
Basic: A simple title like 'Authorized Use Only' establishes a baseline warning, fulfilling the minimum requirement to notify users of the system's private nature.
Moderate: 'Warning: Authorized Access Only' is more explicit. The inclusion of the word 'Warning' adds legal weight and ensures the message is unambiguous, which is a common practice in many compliance frameworks.
Strict: 'Legal Notice and Consent Banner' is the most robust option. This title formally classifies the message as a legal instrument, clearly stating that proceeding implies consent to the terms and monitoring policies outlined in the accompanying message text. This is the recommended standard for environments requiring high security and legal defensibility, such as government or financial institutions.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Authorized Use Only']` |
| **Moderate** | `['Warning: Authorized Access Only']` |
| **Strict** | `['Legal Notice and Consent Banner']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry for the 'Interactive logon: Message title for users attempting to log on' setting. The script must read the 'LegalNoticeCaption' string value from the registry key 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System'. The script's output must be only the raw string value of the setting. If the value does not exist, the script should output an empty string.

## Remediation Script Working

PowerShell script that accepts a single string value as a positional command-line argument to configure the 'Interactive logon: Message title for users attempting to log on'. The script must set the 'LegalNoticeCaption' registry value at 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System' to the provided argument string. The script must return '$true' upon successful modification and '$false' if it fails.

