# Ensure 'Network security: Do not store LAN Manager hash value on next password change' is set to 'Enabled'

Necessity: The LAN Manager (LM) hash is an outdated and weak cryptographic algorithm used in early versions of Windows. These hashes are highly susceptible to brute-force and rainbow table attacks, allowing attackers who gain access to the password hash database (SAM) to quickly crack user passwords. Disabling the storage of LM hashes forces the system to rely solely on newer, much stronger hashing algorithms like NTLMv2 or Kerberos, significantly enhancing password security and mitigating the risk of credential theft and privilege escalation.

Auditing and Remediation: The audit script inspects the 'NoLMHash' registry value under 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' to determine if the policy is active. The remediation script directly modifies this registry value, setting it to '1' to enable the policy, which instructs the operating system to no longer generate or store the LM hash of a user's password upon the next password change.

Recommended State Rationale: Basic, Moderate, and Strict security levels all recommend the 'Enabled' state. This is a binary security control with no middle ground; storing LM hashes is insecure under all circumstances in modern networks. Enabling this setting is a foundational security best practice universally recommended by standards like the CIS Benchmarks and DISA STIGs. Therefore, any level of security hardening requires this setting to be enabled.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry value 'NoLMHash' at the path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'. If the value data is '1', the script must return the string 'Enabled'. If the value data is '0' or the value does not exist, it must return 'Disabled'. The script must only output the resulting string and nothing else.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument, which must be either 'Enabled' or 'Disabled'. The script must configure the 'NoLMHash' REG_DWORD value at 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' to '1' for 'Enabled' or '0' for 'Disabled'. The script must return the boolean value '$true' on success and '$false' on failure.

