# Ensure 'Audit File Share' is set to 'Success and Failure'

Necessity: Auditing file share access is critical for detecting unauthorized attempts to access, modify, or delete sensitive data residing on network shares. This setting logs events for every access attempt, providing a detailed trail for security analysis and incident response. Without this auditing, an attacker's lateral movement through the network and access to critical files could go completely undetected, creating a major security blind spot. It is essential for compliance with data protection regulations and for forensic investigations following a potential breach.

Auditing and Remediation: The audit script leverages the Windows command-line tool `auditpol.exe` to query the current audit policy for the 'File Share' subcategory and returns the inclusion setting. The remediation script uses the same tool to set the policy, enabling or disabling auditing for success and failure events based on the provided input parameter.

Recommended State Rationale: The recommendation for all levels (Basic, Moderate, and Strict) is 'Success and Failure'. This is because a complete security picture requires visibility into both types of events. 
- Basic: 'Success and Failure' is the baseline requirement. Auditing successful access helps identify unusual data access patterns by legitimate users or compromised accounts. Auditing failures is crucial for detecting attempts at unauthorized access, such as permission probing or brute-force attacks against network shares.
- Moderate: This level maintains the 'Success and Failure' setting, as any lesser configuration (e.g., only 'Success') is insufficient. For instance, auditing only failures would miss a successful data exfiltration event by an attacker using a valid, compromised account.
- Strict: The strict recommendation reinforces that for a high-security environment, comprehensive logging is non-negotiable. Logging both outcomes provides the richest data set for Security Information and Event Management (SIEM) systems to correlate events and detect sophisticated attack patterns, aligning with best practices like the CIS Benchmarks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Success and Failure']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to retrieve the current setting for the 'File Share' audit policy. The script must execute `auditpol /get /subcategory:"File Share"` and parse the output to isolate and return only the value of the 'Inclusion Setting' (e.g., 'Success and Failure', 'No Auditing'). The output must be a single string with no extra text or labels.

## Remediation Script Working

PowerShell script that configures the 'File Share' audit policy. The script must accept a single command-line argument specifying the desired state ('Success and Failure', 'Success', 'Failure', 'No Auditing'). Based on the argument, it will execute the appropriate `auditpol /set /subcategory:"File Share"` command with the correct `/success` and `/failure` switches. The script must return `$true` if the command executes successfully and `$false` otherwise.

