# Ensure 'Audit Other Logon/Logoff Events' is set to 'Success and Failure'

Necessity: Auditing 'Other Logon/Logoff Events' is critical for comprehensive security monitoring. These events track non-interactive activities such as remote desktop connections, workstation locks/unlocks, and network share disconnects. Failure to audit both success and failure events creates significant blind spots, making it difficult to detect unauthorized access, lateral movement by attackers, or reconnaissance activities. Misconfiguration can prevent security teams from identifying the initial stages of a breach or tracing an intruder's actions.

Auditing and Remediation: The audit script uses the native 'auditpol.exe' utility to retrieve the current auditing policy for the 'Other Logon/Logoff Events' subcategory. The remediation script uses the same utility to set the policy, enabling or disabling auditing for success and failure events based on the provided input.

Recommended State Rationale: For this policy, the recommended state is consistently 'Success and Failure' across all security levels. 
- Basic: Capturing both 'Success and Failure' is the fundamental requirement for effective security monitoring, as established by benchmarks like CIS. Auditing failures is essential for detecting brute-force attempts or credential stuffing, while auditing successes is crucial for tracking the actions of a potentially compromised account. 
- Moderate & Strict: There is no more secure state for this setting than auditing both outcomes. Disabling either success or failure auditing would create a security gap, regardless of the hardening level. Therefore, 'Success and Failure' remains the only appropriate recommendation for a robust security posture.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Success and Failure']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that executes the 'auditpol /get /subcategory:"Other Logon/Logoff Events"' command. The script must parse the output to extract and return only the value of the 'Inclusion Setting' (e.g., 'Success and Failure', 'No Auditing'). The output must not contain any extra text or labels.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument specifying the desired audit state ('Success and Failure', 'Success', 'Failure', 'No Auditing'). The script must use 'auditpol.exe' to configure the 'Other Logon/Logoff Events' subcategory accordingly. The script must return the boolean value '$true' if the configuration is successful and '$false' if it fails.

