# Ensure 'Audit Other Policy Change Events' is set to include 'Failure'

Necessity: Auditing 'Other Policy Change Events' is crucial for tracking modifications to the Windows Filtering Platform (WFP) and security policy processing configurations. Failure to audit these events can allow malicious actors or misconfigurations to alter critical security controls, such as firewall rules or user rights, without detection. Specifically, logging 'Failure' events is vital as it captures attempted unauthorized changes, which often serve as an early indicator of an attack. Auditing and Remediation: The audit script leverages the native `auditpol.exe` command-line tool to retrieve the current audit setting for the 'Other Policy Change Events' subcategory. The remediation script uses the same tool with `/set` parameters to configure the system to audit for success, failure, or both, based on the provided input. Recommended State Rationale: The Basic state of ['Failure'] ensures that any unsuccessful attempt to modify these critical policies is logged, providing a baseline for detecting malicious activity. The Moderate and Strict state of ['Success and Failure'] is the highly recommended configuration. It provides a comprehensive audit trail by logging all changes, whether successful or not. This complete visibility is essential for robust security monitoring, forensic investigations following an incident, and verifying authorized administrative changes, thereby ensuring the integrity of the system's security posture.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Failure']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that executes `auditpol.exe /get /subcategory:"Other Policy Change Events"`. The script must parse the command's output to return only the current setting value (e.g., 'No Auditing', 'Success', 'Failure', 'Success and Failure').

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument specifying the desired audit state ('Success', 'Failure', 'Success and Failure', 'No Auditing'). The script must use `auditpol.exe /set` to configure the 'Other Policy Change Events' subcategory accordingly, enabling or disabling success and failure auditing based on the input. The script must return `$true` upon successful application of the setting and `$false` on failure.

