# Ensure 'Set the default behaviour for AutoRun' is set to 'Enabled: Do not execute any autorun commands'

The AutoRun and AutoPlay features in Windows are designed to automatically perform actions when new media, such as a USB drive or CD-ROM, is inserted into the system. While convenient, this functionality is a significant security risk and has historically been a primary vector for malware propagation. Malicious code on a removable device can automatically execute upon insertion, infecting the system without any user interaction. Disabling AutoRun for all drives is a critical security hardening measure that mitigates the risk of infection from worms and Trojans like Conficker and Stuxnet that spread through removable media. The audit script verifies this protective setting by checking the relevant registry value ('NoDriveTypeAutoRun') to ensure it is configured to disable AutoPlay on all drive types. The remediation script enforces this state by creating or modifying the registry value to the secure setting. The recommended state for Basic, Moderate, and Strict security levels is identical because there is no secure middle ground; any allowance for AutoRun introduces an unnecessary risk. The most secure configuration, recommended by benchmarks like CIS, is to disable this feature entirely across all drives.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled: Do not execute any autorun commands']` |
| **Moderate** | `['Enabled: Do not execute any autorun commands']` |
| **Strict** | `['Enabled: Do not execute any autorun commands']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the registry for the 'Turn off Autoplay' policy. The script must check the DWORD value 'NoDriveTypeAutoRun' under the key 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer'. If the value data is '255' (0xFF), the script must return the string 'Enabled: Do not execute any autorun commands'. For any other value or if the key is not present, it must return the string 'Disabled or Not Configured'. The script should output only the resulting string value.

## Remediation Script Working

PowerShell script that accepts a single positional string argument. The only valid argument is 'Enabled: Do not execute any autorun commands'. When this argument is provided, the script must set the DWORD registry value 'NoDriveTypeAutoRun' to '255' under the key 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer'. The script must create the registry key path if it does not exist. The script must return '$true' on success and '$false' on failure or if an invalid argument is supplied.

