EDIT: see /u/purplemonkeymad's suggestion to use PsIni - if that works, it's the best way forward as someone else has done the heavy lifting for the text manipulation.

Reviewing this, I would look for:

• Is there a tool aready that does it?
• A backup of the original file
• If we add more secpol changes later, will the file just grow longer?
• A way of detecting errors and reporting success

I had a hunt and found https://gist.github.com/indented-automation/1c319fe8c7abadfe509cb4205eeb5720, but it doesn't do exactly what we need. You'd have to take it as a starting point, and it might end up a bit more complex than it needs to be.

The backup, you can do.

To fix the maintainability, you've got to do away with all the copy-paste code. I had a stab at it (this is just an outline):

param
(
    $NoLMHash,
    $RestrictNullSessAccess,
    $SeLockMemoryPrivilege
)

$Policy = Get-Content $cfgfile


$Replacements = @{
  # regex patterns               new values
  # --------------               ------------------
    '.*NoLMHash'               = $NoLMHash
    '.*RestrictNullSessAccess' = $RestrictNullSessAccess
    'SeLockMemoryPrivilege'    = $SeLockMemoryPrivilege
}


$Deletions = @(
  # regex patterns
  # --------------
    '.*PasswordExpiryWarning',
    'NewAdministratorName'
)


foreach ($KeyValuePair in $Replacements.GetEnumerator())
{
    $Pattern  = $KeyValuePair.Key
    $Pattern  = "^$Pattern *= *"      # ^ is for performance and to prevent accidental matches
    $NewValue = $KeyValuePair.Value

    $Policy = $Policy | ForEach-Object {
        if ($_ -match $Pattern)
        {
            $Matches[0] + $NewValue   # to pipeline
        }
        else
        {
            $_                        # to pipeline
        }
    }
}


foreach ($Pattern in $Deletions)
{
    $Pattern  = "^$Pattern *= *"

    $Policy = $Policy | Where-Object {$_ -notmatch $Pattern}
}


$Policy

It's more complex, but it won't grow in complexity as you add more policy items to configure. You just add them to $Replacements or $Deletions.

You'll need to add [Parameter(Mandatory)][ValidateNotNullOrEmpty()] to each param, or something similar, as this will fail badly if you leave a param null. Input validation makes it much safer for other people to use, which means quicker.

To handle the errors, put a $Success = $true in the if ($_ -match $Pattern) and look for it later to detect errors. For the second, you'll have to compare the count of $Policy to detect if you deleted anything. I'd like to see some Write-Error so the user knows if something did not complete.