# Ensure 'Configure Microsoft Defender Application Guard clipboard settings: Clipboard behaviour setting' is set to 'Enabled: Enable clipboard operation from an isolated session to the host'

Necessity: Microsoft Defender Application Guard provides a hardware-isolated browsing environment to protect the host OS from untrusted websites and documents. The clipboard setting governs data transfer between this isolated session and the host computer. A misconfigured clipboard can create a vector for malicious data to be transferred from the isolated session to the host, or for sensitive data to be exfiltrated from the host into the potentially compromised isolated session, undermining the container's security. Auditing and Remediation: The audit script reads the registry value that controls the clipboard's behavior, determining the direction and type of content allowed. The remediation script directly modifies this registry value to enforce the desired security policy. Recommended State Rationale: Basic: ['1'] - 'Enable clipboard operation from an isolated session to the host'. This state allows users to copy content they trust from the isolated session back to their primary desktop, balancing security with usability. Moderate: ['0'] - This state disables the clipboard entirely. It aligns with security benchmarks like CIS, which recommend preventing all data transfer via the clipboard to maintain the strongest possible isolation boundary. Strict: ['0'] - The strictest configuration is identical to the moderate one. Disabling the clipboard completely enforces the principle of least privilege by eliminating this data channel, offering the maximum protection against both host compromise and data exfiltration.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['1']` |
| **Moderate** | `['0']` |
| **Strict** | `['0']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the registry value 'ClipboardOptions' at 'HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI'. The script must return only the current numerical value. If the value does not exist, the script should return '0', as this reflects the default disabled behavior.

## Remediation Script Working

PowerShell script that sets the 'ClipboardOptions' REG_DWORD value at 'HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI'. The script must accept a single numerical value (e.g., 0, 1, 2, or 3) as a positional command-line argument. The script must create the registry key path if it does not exist and return '$true' on success or '$false' on failure.

