# Ensure 'Interactive logon: Machine inactivity limit' is set to '900 or fewer second(s), but not 0'

The 'Interactive logon: Machine inactivity limit' setting determines the period of user inactivity before the session is automatically locked. This is a critical security control to prevent unauthorized access to a system when a user leaves their workstation unattended. An unlocked, active session provides an opportunity for malicious actors or unauthorized individuals to steal data, install malware, or gain further access to the network. Setting this limit mitigates the risk of such opportunistic physical attacks. The audit script verifies this setting by reading the 'InactivityTimeoutSecs' registry value, which stores the timeout in seconds. The remediation script directly modifies this registry value to enforce the desired security policy. The Basic state of [1, 900] seconds (15 minutes) aligns with common industry benchmarks like CIS as a fundamental security measure. The Moderate state of [1, 600] seconds (10 minutes) reduces the window of exposure and is suitable for environments with more sensitive data or higher physical traffic. The Strict state of [1, 300] seconds (5 minutes) provides the highest level of protection, ensuring that unattended sessions are secured very quickly, which is appropriate for high-security environments.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[900,1]` |
| **Moderate** | `[600,1]` |
| **Strict** | `[300,1]` |
| **Type** | `RANGE` |

## Audit Script Working

PowerShell script that queries the registry value 'InactivityTimeoutSecs' at 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. The script should handle cases where the value does not exist, in which case it should return 0. The output must be the current numeric value and nothing else.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument, which is the desired timeout in seconds. The script must set the DWORD registry value 'InactivityTimeoutSecs' at 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' to this argument. The script must return '$true' upon successful modification or '$false' if it fails.

