# Ensure 'Audit Other Policy Change Events' is set to include 'Failure'

Necessity: Auditing 'Other Policy Change Events' is critical for monitoring changes to security policies not covered by other specific audit categories, such as Windows Firewall policy modifications or changes to security options. Failure to audit these events creates a security blind spot. Specifically, logging failed attempts can provide an early warning that an attacker or unauthorized user is attempting to weaken the system's security posture. A misconfiguration that disables this auditing removes a key source of data for intrusion detection and forensic analysis. 

Auditing and Remediation: The audit script uses the 'auditpol.exe' command-line tool to retrieve the current audit setting for the 'Other Policy Change Events' subcategory. The remediation script uses the same tool to set the audit policy for success and/or failure events based on the desired state provided as an argument. 

Recommended State Rationale: 
- Basic: ['Failure'] - This level ensures that unsuccessful attempts to change security policies are logged. This is the minimum requirement for detecting potential malicious activity, as it captures evidence of unauthorized users attempting to alter system defenses. 
- Moderate: ['Success and Failure'] - This state provides a comprehensive audit trail by logging both successful and failed events. Auditing successful changes is crucial for change management, accountability, and verifying that only authorized modifications have occurred. This is the standard best practice recommendation. 
- Strict: ['Success and Failure'] - This is the most secure and recommended state, identical to Moderate. Logging both outcomes provides complete visibility into all attempts to modify these critical security policies, which is essential for robust security monitoring and incident response in high-security environments.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Failure']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the 'Other Policy Change Events' audit policy subcategory using 'auditpol.exe'. The script must parse the output to isolate the current inclusion setting (e.g., 'No Auditing', 'Success', 'Failure', 'Success and Failure') and return only this value as a string.

## Remediation Script Working

PowerShell script that accepts a single string argument defining the desired audit state ('No Auditing', 'Success', 'Failure', 'Success and Failure'). The script must use 'auditpol.exe' to configure the 'Other Policy Change Events' subcategory by setting the '/success' and '/failure' switches according to the input argument. The script must return '$true' on successful execution or '$false' on failure.

