# Ensure 'Allow Administrator account lockout' is set to 'Enabled' (Manual)

Necessity: The built-in Administrator account (RID 500) is a well-known, high-value target for brute-force attacks. By default, this account is immune to account lockout policies, allowing attackers unlimited password guessing attempts. Enabling this setting ensures the Administrator account is subject to the same lockout policy as other accounts, significantly mitigating the risk of a compromise through brute-force methods. Failure to enable this setting leaves a critical security vulnerability.

Auditing and Remediation: The audit script programmatically checks the local security database to determine the current state of the 'EnableAdminAccountLockout' flag. The remediation script modifies this security setting by creating and applying a security template that enforces the desired state, thereby enabling the lockout policy for the built-in Administrator account.

Recommended State Rationale: 
- Basic: ['Enabled']. This is the minimum acceptable security configuration. Any system connected to a network must protect its most privileged accounts from basic brute-force attacks.
- Moderate: ['Enabled']. As this is a binary and foundational security setting, the recommendation remains the same. There is no intermediate state; the account is either protected by lockout or it is not.
- Strict: ['Enabled']. For a strict security posture, enabling this setting is non-negotiable. It is a fundamental control required by numerous security frameworks (e.g., CIS Benchmarks) to protect against credential-based attacks on privileged accounts.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to audit the 'Allow Administrator account lockout' setting. The script must export the local security policy using `secedit.exe /export /cfg $tempfile`, parse the resulting file to find the value of 'EnableAdminAccountLockout', and then delete the temporary file. The script should output only the current value ('1' for Enabled, '0' for Disabled) with no extra text or labels.

## Remediation Script Working

PowerShell script that accepts a single positional argument ('1' for Enabled or '0' for Disabled). The script must create a temporary `.inf` file with the content `[System Access]` followed by `EnableAdminAccountLockout = <argument_value>`. It will then apply this configuration using `secedit.exe /configure /db %windir%\security\new.sdb /cfg <inf_file> /quiet`. The script must delete the temporary file and return `$true` on success or `$false` on failure.

