# Ensure 'Interactive logon: Don't display last signed in' is set to 'Enabled'

Necessity: This setting prevents the username of the last person who logged on from being displayed on the logon screen. Exposing valid usernames provides attackers with half the information needed to compromise an account, significantly simplifying brute-force or password-spraying attacks. By hiding this information, it forces an attacker to guess both a valid username and its corresponding password, increasing the difficulty of unauthorized access. Auditing and Remediation: The audit script checks the 'dontdisplaylastusername' registry value to determine the current configuration. The remediation script directly modifies this registry value, setting it to 1 to enable the policy, thereby hiding the last signed-in username from the logon screen. Recommended State Rationale: Basic, Moderate, and Strict levels all recommend 'Enabled' because this is a binary security control with no intermediate state. The 'Enabled' state is the only secure configuration, aligning with security benchmarks like CIS. Disabling this feature provides an unnecessary advantage to potential attackers and is not recommended in any secure environment. Therefore, the highest level of protection is achieved and maintained by keeping this setting enabled across all hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the value of 'dontdisplaylastusername' in the registry key 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System'. The script should output 'Enabled' if the REG_DWORD value is 1, and 'Disabled' if the value is 0 or does not exist. The output must consist solely of the state string.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument, which must be either 'Enabled' or 'Disabled'. If the argument is 'Enabled', the script must set the registry key 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System' value 'dontdisplaylastusername' to a REG_DWORD of 1. If 'Disabled', it must set the value to 0. The script must return $true on successful modification and $false on failure.

