# Ensure 'Audit Application Group Management' is set to 'Success and Failure'

Necessity: Auditing 'Application Group Management' is crucial for tracking changes to application groups, which control access to resources based on user, device, and resource claims. Misconfiguration or malicious modification of these groups can lead to unauthorized access, privilege escalation, or denial of service. Capturing both success and failure events provides a comprehensive audit trail to detect and investigate unauthorized attempts to alter access rights, which is essential for security monitoring and incident response.

Auditing and Remediation: The audit script uses the `auditpol.exe` utility to read the current audit policy for the 'Application Group Management' subcategory. The remediation script uses the same utility to set the audit policy, enabling or disabling auditing for success and failure events based on the provided argument.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Success and Failure'. This is because a complete audit trail is fundamental for this setting. Auditing only 'Success' events misses potentially malicious failed attempts to change permissions. Auditing only 'Failure' events misses successful but unauthorized changes. Therefore, logging both is the standard best practice (e.g., per CIS Benchmarks) to ensure a complete and actionable security log for forensic analysis and real-time alerting.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Success and Failure']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that uses `auditpol.exe` to retrieve the current inclusion setting for the 'Application Group Management' subcategory. The script must parse the command's output to isolate and return only the current auditing value (e.g., 'Success and Failure', 'No Auditing', 'Success', or 'Failure'), with no additional text or formatting.

## Remediation Script Working

PowerShell script that accepts a single positional string argument specifying the desired audit level ('Success and Failure', 'Success', 'Failure', or 'No Auditing'). The script will use `auditpol.exe` to configure the 'Application Group Management' subcategory accordingly. For 'Success and Failure', it must enable both success and failure auditing. The script must return `$true` upon successful application of the setting and `$false` if an error occurs or the input is invalid.

