# Ensure 'Accounts: Limit local account use of blank passwords to console logon only' is set to 'Enabled'

Necessity: This setting is crucial for preventing unauthorized network access. Accounts with blank passwords are a significant security vulnerability. By enabling this policy, their usage is restricted to physical console logons only, thwarting attempts by attackers to exploit such accounts for remote access via services like RDP or file shares. A misconfiguration (setting to 'Disabled') would allow an attacker to easily compromise the system remotely if they discover a local account with a blank password.

Auditing and Remediation: The audit script queries the 'LimitBlankPasswordUse' registry value under the LSA control key to determine the policy's current state ('Enabled' for a value of 1, 'Disabled' otherwise). The remediation script directly modifies this registry value to enforce the desired state, effectively enabling or disabling the restriction on blank password use for network logons.

Recommended State Rationale: Basic, Moderate, and Strict are all set to 'Enabled' because this is a fundamental security control with no valid reason for a less secure configuration in a production environment. Allowing network logons with blank passwords is a critical risk. The 'Enabled' state is the universally accepted best practice (e.g., by CIS Benchmarks) and is considered the minimum baseline for any secure system. There is no intermediate or stricter setting; the policy is either correctly enforced or it is not.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that checks the registry key 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' for the value 'LimitBlankPasswordUse'. If the value is '1', the script must return the string 'Enabled'. If the value is '0' or does not exist, it must return 'Disabled'. The script's output must be only the current state string, with no additional text or formatting.

## Remediation Script Working

PowerShell script that accepts a single command-line argument. The script must set the registry value 'LimitBlankPasswordUse' (type DWORD) at 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'. If the argument is 'Enabled', set the value to '1'. If the argument is 'Disabled', set the value to '0'. The script must return '$true' on successful modification and '$false' on failure.

