# Ensure 'Network access: Let Everyone permissions apply to anonymous users' is set to 'Disabled'

Necessity: This setting determines if anonymous connections are included in the 'Everyone' security group. If enabled, anonymous users can access any resource that grants permissions to the 'Everyone' group, which can lead to unauthorized information disclosure or access to sensitive shared resources like folders, printers, and registry keys. Disabling this is a critical security measure to prevent unauthenticated users from enumerating system information and accessing resources. Auditing and Remediation: The audit script checks the value of the 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\everyoneincludesanonymous' registry key to determine the current state. The remediation script modifies this key, setting its value to 0 to align with the 'Disabled' state. Recommended State Rationale: The only secure configuration for this setting is 'Disabled'. Allowing anonymous users to be part of the 'Everyone' group introduces significant and unnecessary risk. Therefore, this state is recommended across all security levels (Basic, Moderate, and Strict) as a foundational security best practice, and is a common recommendation in benchmarks such as CIS.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry value 'everyoneincludesanonymous' at 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'. If the value is 0 or does not exist, the script must output 'Disabled'. If the value is 1, it must output 'Enabled'. The output must be only the current state string, with no additional text or formatting.

## Remediation Script Working

PowerShell script that accepts a single positional string argument: 'Enabled' or 'Disabled'. The script must set the registry DWORD value 'everyoneincludesanonymous' at 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' to 1 if the argument is 'Enabled' and 0 if 'Disabled'. The script must return the boolean '$true' on success and '$false' on failure.

