# Ensure 'Audit User Account Management' is set to 'Success and Failure'

Necessity: Auditing user account management is critical for security monitoring. It tracks events such as account creation, deletion, password changes, and modifications to group memberships. This helps detect unauthorized account creation (e.g., for persistence), privilege escalation, or attempts to compromise existing accounts. Without this auditing, an attacker's activities related to account manipulation could go unnoticed, creating a significant blind spot in the organization's security posture and hindering incident investigation.

Auditing and Remediation: The audit script uses the built-in `auditpol.exe` utility to retrieve the current audit policy for the 'User Account Management' subcategory. The remediation script uses the same utility to set the policy, enabling or disabling auditing for successful and/or failed events based on the desired state provided as an argument.

Recommended State Rationale:
- Basic: ['Success'] - This level logs all successful user account management events. It provides a fundamental audit trail of legitimate administrative actions, which is essential for change management and basic forensic analysis.
- Moderate: ['Success and Failure'] - This level is significantly more secure as it also logs failed attempts. Failed events can be early indicators of malicious activity, such as an intruder trying to create a backdoor account, brute-force password changes, or other unauthorized actions. Capturing failures is essential for proactive threat detection.
- Strict: ['Success and Failure'] - This is the highest recommended state and aligns with security frameworks like the CIS Benchmarks. It provides a comprehensive log of all attempted and completed user account management activities. This complete visibility is non-negotiable for high-security environments, enabling thorough incident response and detection of both insider threats and external attacks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Success']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that executes `auditpol /get /subcategory:"User Account Management"`. The script must parse the command's output to isolate and return only the current setting value (e.g., 'Success and Failure', 'Success', 'Failure', or 'No Auditing').

## Remediation Script Working

PowerShell script that accepts a single string argument specifying the desired audit level ('Success and Failure', 'Success', 'Failure', or 'No Auditing'). The script must use `auditpol.exe` to configure the 'User Account Management' subcategory accordingly. It must return `$true` upon successful application of the setting and `$false` if the command fails or the input is invalid.

