# Ensure 'Interactive logon: Do not require CTRL+ALT+DEL' is set to 'Disabled'

Necessity: The CTRL+ALT+DEL key combination is a Secure Attention Sequence (SAS) in Windows. Requiring it for logon ensures that the user is interacting with the legitimate Windows operating system logon screen, rather than a malicious program spoofing the logon prompt to capture credentials. Disabling this requirement (setting the policy to 'Enabled') exposes the system to password theft through Trojan horse programs or other credential harvesting attacks. Auditing and Remediation: The audit script reads the registry value 'DisableCAD' under 'HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon' to determine the current state. A value of 0 means the policy is 'Disabled' (secure), while a value of 1 means it is 'Enabled' (insecure). The remediation script modifies this same registry value to enforce the desired state. Recommended State Rationale: Basic, Moderate, and Strict levels are all set to 'Disabled'. This is a foundational security setting with no degrees of security; it is either secure or it is not. The 'Disabled' state enforces the SAS, which is the universally recommended best practice by security frameworks like the CIS Benchmarks. The 'Enabled' state offers no security benefit and introduces a critical vulnerability, making 'Disabled' the only acceptable configuration for any level of system hardening.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that checks the registry value at 'HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon' for the key 'DisableCAD'. If the value is 1, the script should output 'Enabled'. If the value is 0 or does not exist, it should output 'Disabled'. The script must return only the resulting string value ('Enabled' or 'Disabled') and nothing else.

## Remediation Script Working

PowerShell script that accepts a single command-line argument: 'Enabled' or 'Disabled'. The script should set the registry value 'DisableCAD' (REG_DWORD) at 'HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon'. If the argument is 'Enabled', set the value to 1. If 'Disabled', set the value to 0. The script must return '$true' upon successful modification or if the setting is already correct, and '$false' upon failure.

