# Ensure 'Allow log on locally' is set to 'Administrators, Users'

The 'Allow log on locally' policy setting determines which users can start an interactive session on the computer's console. Necessity: This is a critical security control that upholds the principle of least privilege. Granting this right to unnecessary accounts, such as standard users on a server, significantly increases the attack surface. If a standard user account is compromised, an attacker could use it to log on interactively, access local resources, and attempt to escalate privileges. Restricting this right ensures that only authorized administrative personnel can access the machine's console directly. Auditing and Remediation: The audit script reads the local security policy to identify all accounts granted the 'SeInteractiveLogonRight' (Allow log on locally). The remediation script modifies this policy by explicitly setting the right for a specified list of accounts, removing it from all others. Recommended State Rationale: Basic: ['Administrators,Users'] is the default for Windows client machines, suitable for general-purpose workstations where multiple standard users need to log in. Moderate: ['Administrators'] is the CIS Benchmark recommended state for all systems. It restricts local logon to only the built-in Administrators group, which is appropriate for servers and secure workstations where standard users should not have interactive console access. Strict: ['Administrators'] remains the strict recommendation. Further restriction is environment-specific and risks locking out all administrative access to the console, which is critical for disaster recovery. This state ensures that only privileged accounts can perform local logons.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Administrators,Users']` |
| **Moderate** | `['Administrators']` |
| **Strict** | `['Administrators']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the 'Allow log on locally' (SeInteractiveLogonRight) user right assignment. The script must resolve the Security Identifiers (SIDs) to their account names and output a single, comma-separated string of these names (e.g., 'Administrators,Users'). The output must not contain any labels or extra text.

## Remediation Script Working

PowerShell script that sets the 'Allow log on locally' (SeInteractiveLogonRight) user right. The script must accept a single command-line argument: a comma-separated string of user and group names (e.g., 'Administrators,Users'). The script will convert these names to their corresponding SIDs, apply the policy, and must return $true on success or $false on failure.

