# Ensure 'Audit Sensitive Privilege Use' is set to 'Success and Failure'

The 'Audit Sensitive Privilege Use' policy determines whether the operating system generates audit events when a user account or service exercises a sensitive privilege. These privileges, such as 'Act as part of the operating system' or 'Take ownership of files or other objects,' grant significant control and can be exploited in privilege escalation attacks. Auditing their use is critical for detecting and investigating potential system compromises or malicious activity. A misconfiguration could create a significant blind spot, allowing an attacker to elevate permissions undetected. The audit script checks the current configuration using 'auditpol.exe'. The remediation script uses the same utility to set the desired audit level (Success, Failure, or both). For this setting, 'Success and Failure' is the recommended state across all hardening levels (Basic, Moderate, and Strict). Auditing successful uses is essential to track legitimate and potentially malicious activity, while auditing failures is crucial for identifying attempted attacks. There is no more secure setting than auditing both outcomes, making it the universal best practice.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Success and Failure']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to retrieve the current setting for the 'Sensitive Privilege Use' advanced audit policy. The script must execute 'auditpol /get /subcategory:"Sensitive Privilege Use"', parse the output, and return only the value of the 'Inclusion Setting' (e.g., 'Success and Failure', 'Success', 'No Auditing').

## Remediation Script Working

PowerShell script that configures the 'Sensitive Privilege Use' audit policy. The script must accept a single, positional command-line argument with the desired state ('Success and Failure', 'Success', 'Failure', 'No Auditing'). The script will parse this argument to enable/disable success and failure auditing via 'auditpol.exe' and must return '$true' on success or '$false' on failure.

