# Ensure 'Network access: Allow anonymous SID/Name translation' is set to 'Disabled'

Necessity: This setting determines whether an anonymous user can request the Security Identifier (SID) attributes for another user. Enabling this feature allows an anonymous user to translate a SID into a user or group name, which can reveal sensitive account information (e.g., the name of the built-in Administrator account). This information can be leveraged by attackers during the reconnaissance phase of an attack to target specific accounts for password guessing or social engineering. Disabling this feature is a critical step in preventing unauthorized information disclosure and hardening the system against network-based attacks. Auditing and Remediation: The audit script checks the value of the 'TurnOffAnonymousBlock' registry entry under 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' to determine the current state. The remediation script directly modifies this registry value to either 0 (Enabled) or 1 (Disabled) to enforce the desired security policy. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Disabled'. This is a binary security control with no valid operational reason to be enabled in a production environment. Any state other than 'Disabled' exposes the system to unnecessary risk. Therefore, all recognized security benchmarks, including CIS and DISA STIGs, mandate this setting be disabled to provide a fundamental layer of security.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry value 'TurnOffAnonymousBlock' at 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'. If the value data is 1, the script must output only the string 'Disabled'. If the value data is 0 or the value does not exist, it must output only the string 'Enabled'. There should be no other text in the output.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument, which will be either 'Enabled' or 'Disabled'. If the argument is 'Disabled', the script must set the registry DWORD value 'TurnOffAnonymousBlock' at 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' to 1. If the argument is 'Enabled', it must set the value to 0. The script must create the value if it does not exist. It must return the boolean '$true' on success and '$false' on failure.

