# Ensure 'Allow auditing events in Microsoft Defender Application Guard' is set to 'Enabled'

Necessity: Microsoft Defender Application Guard (MDAG) provides hardware-based isolation for untrusted web content and documents, preventing them from accessing the host system. Enabling auditing for MDAG is critical for security visibility. It logs events that occur within the isolated container, such as attempts to access host resources, clipboard operations, or printing. Without these logs, an organization would be blind to malicious activities or exploit attempts occurring within the MDAG environment, hindering incident detection, response, and forensic analysis. This setting ensures that security-relevant actions are recorded in the Windows Event Log.

Auditing and Remediation: The audit script checks the registry value `HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI\AuditApplicationGuard`. A value of `1` indicates auditing is enabled, while `0` or the absence of the value indicates it is disabled. The remediation script modifies this same registry key, setting the `REG_DWORD` value to `1` to activate event logging for all Application Guard sessions.

Recommended State Rationale: 
- Basic: ['Enabled']
- Moderate: ['Enabled']
- Strict: ['Enabled']

The recommendation for all security levels is 'Enabled' because this is a fundamental visibility feature with no performance trade-off that would justify disabling it. Security monitoring is not a setting that should be tiered. For any organization using Application Guard, capturing these audit logs is essential for maintaining a minimum baseline of security. There is no 'more enabled' state, and disabling it creates a significant and unnecessary security blind spot. Therefore, enabling auditing is the universal best practice for all hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry value `AuditApplicationGuard` under the key `HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI`. The script must return '1' if the value data is 1 (Enabled). If the value data is 0 or the key/value does not exist, it must return '0' (Disabled). The output should only be the numeric value.

## Remediation Script Working

PowerShell script that accepts a single positional argument ('1' for Enabled or '0' for Disabled). The script must set the `REG_DWORD` value `AuditApplicationGuard` at the registry path `HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI`. If the path does not exist, the script must create it first. The script must return `$true` on success and `$false` on failure.

