# Ensure 'Adjust memory quotas for a process' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE'

Necessity: The 'Adjust memory quotas for a process' user right determines which accounts can change the maximum memory available to a process. This is a powerful privilege that, if granted to unauthorized accounts, could be abused to perform denial-of-service (DoS) attacks by starving critical system processes of memory, causing them to fail. Misconfiguration creates a significant risk of system instability and could be leveraged by malware to disable security software.

Auditing and Remediation: The audit script inspects the local security policy to identify all accounts currently assigned the 'SeIncreaseQuotaPrivilege'. The remediation script modifies this policy, overwriting the existing list of accounts with the provided, correct set of principals, thereby enforcing the principle of least privilege.

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is the Windows default of 'Administrators, LOCAL SERVICE, NETWORK SERVICE'. This configuration adheres to the principle of least privilege. 'Administrators' require this right for system management tasks. 'LOCAL SERVICE' and 'NETWORK SERVICE' are built-in accounts used by essential Windows services that need this capability to function correctly. Granting this right to additional users or groups is a security risk and is not recommended. Removing any of the default principals may cause system or application failures. Therefore, the default configuration is considered the most secure and stable baseline.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Administrators,LOCAL SERVICE,NETWORK SERVICE']` |
| **Moderate** | `['Administrators,LOCAL SERVICE,NETWORK SERVICE']` |
| **Strict** | `['Administrators,LOCAL SERVICE,NETWORK SERVICE']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the system's security policy for the 'Adjust memory quotas for a process' user right (SeIncreaseQuotaPrivilege). The script must resolve the Security Identifiers (SIDs) to their account names and output only a single comma-separated string of these names (e.g., 'Administrators,LOCAL SERVICE,NETWORK SERVICE'), with no headers or extra text.

## Remediation Script Working

PowerShell script that configures the 'Adjust memory quotas for a process' user right (SeIncreaseQuotaPrivilege). The script must accept a single, positional command-line argument which is a comma-separated string of the principals to be assigned (e.g., '"Administrators,LOCAL SERVICE,NETWORK SERVICE"'). The script must apply this configuration and output $true on success and $false on failure.

