Some questions

[pathei-kosmos]

Hi 🙂

1. I don't understand why the activation of an administrator account has been removed? And I didn't understand whether the lockout policy is activated by the script or not?
2. I was thinking back to the problem with the AMD implementation of TPM, and I was wondering if we shouldn't either a) put a warning in the script that if the machine has an AMD processor it's advisable to choose a startup code of at least 16 characters, or b) increase the minimum required code length as a #TopSecurity measure, since the people implementing these measures are willing to sacrifice a bit of usability for more security.
3. Does the script check for a newer version on launch?
4. Why enable Clipboard History synchronization with the Microsoft account?

[HotCakeX]

Hi,

Lockout policy is applied by Microsoft security baseline and the script but they don't have the necessary effect on the built-in administrator account that's disabled by default.

The new lockout behavior only affects network logons, such as RDP attempts. Console logons will still be allowed during the lockout period.

https://support.microsoft.com/en-us/topic/kb5020282-account-lockout-available-for-built-in-local-administrators-bce45c4d-f28d-43ad-b6fe-70156cb2dc00

That makes the built-in administrator less secure than an administrator account connected to a MSA or AAD.

---

The usability is barely sacrificed unless the top security category is also used. Increating minimum Bitlocker startup Pin for everyone isn't logical because that security vuln only applies to subset of AMD CPUs.

I can add an Important message to the Bitlocker section linking to your GitHub issue letting those AMD CPU users know about the vuln.

---

Yes, the script checks for new version when you install and run it from PowerShell gallery, but when running it directly from GitHub you always use the latest version.

---

Clipboard sync with MSA is just a user-mode (non-admin) setting for improved productivity, trying to offset the little loss of usability.

[pathei-kosmos]

Thanks! 🙂
I imagine that a large part of the script's features are unusable if you use a local account?

[HotCakeX]

You can use local account too, you just won't have access to features like Windows Hello for lock screen, logging into websites with phish resistant passkeys instead of username/password etc. 🙂

[HotCakeX]

14be5de

[pathei-kosmos]

Great! Maybe give something like 16 as minimum length, since 20 characters is the maximum accepted by BitLocker anyway.

[HotCakeX]

Thank you, fixed it!

f3cdf0c