# Ensure 'Accounts: Block Microsoft accounts' is set to 'Users can't add or log on with Microsoft accounts'

The 'Accounts: Block Microsoft accounts' policy controls whether users can add or use Microsoft accounts for authentication on a Windows device. Necessity: Enforcing this policy is critical in enterprise environments to maintain strict control over user identities. It prevents users from linking personal Microsoft accounts, which could lead to data leakage through OneDrive synchronization or the circumvention of corporate authentication policies. By restricting authentication to local or domain accounts, organizations can ensure that all access is managed, audited, and controlled centrally. Auditing and Remediation: The audit script checks the registry value 'NoConnectedUser' under 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System', which corresponds to this policy. The remediation script modifies this value to enforce the desired setting. A value of '1' means users can't add accounts, and '3' means they can't add or log on with them. Recommended State Rationale: Basic: A value of ['1'] ('Users can't add Microsoft accounts') is recommended as a baseline to prevent the introduction of new, unmanaged personal accounts. Moderate & Strict: A value of ['3'] ('Users can't add or log on with Microsoft accounts') is recommended for both moderate and strict security postures. This is the most secure setting, aligning with CIS Benchmarks. It completely decouples the device from personal cloud accounts, ensuring that authentication is handled exclusively by enterprise-managed systems, thereby minimizing the attack surface and risk of data exfiltration.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['1']` |
| **Moderate** | `['3']` |
| **Strict** | `['3']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the DWORD value of 'NoConnectedUser' at the registry path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. The script must output only the numerical value. If the key or value does not exist, it should output '0', which is the default disabled state.

## Remediation Script Working

PowerShell script that accepts a single positional argument representing the desired state. The script must set the 'NoConnectedUser' DWORD value at 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' to the provided argument. The script must create the registry key if it does not exist. It must return '$true' on success and '$false' on failure.

