# Ensure 'Audit System Integrity' is set to 'Success and Failure'

Necessity: Auditing system integrity is crucial for monitoring events that could compromise the core security of the operating system. This includes tracking modifications to the Security Account Manager (SAM), detecting invalid logon attempts, and identifying other potential violations of the security subsystem. Failure to enable this audit policy can create a significant blind spot, allowing an attacker to tamper with critical system components or attempt credential theft without generating detectable logs. This setting is a fundamental component of intrusion detection and forensic analysis. \n\nAuditing and Remediation: The audit script uses the native `auditpol.exe` utility to query the current audit setting for the 'System Integrity' subcategory and returns the configured value. The remediation script uses the same utility to set the audit policy, enabling or disabling auditing for success and failure events based on the desired state provided as an argument. \n\nRecommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is 'Success and Failure'. This is because security best practices, including CIS Benchmarks, mandate full visibility into these critical events. Auditing 'Success' events is important for identifying unauthorized but successful actions. Auditing 'Failure' events is essential for detecting malicious attempts, such as brute-force attacks or attempts to exploit vulnerabilities. Disabling either success or failure auditing significantly reduces the effectiveness of the control, hence 'Success and Failure' is the only appropriate recommendation.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Success and Failure']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script. The script must execute the command `auditpol /get /subcategory:"System Integrity"`, parse the output to find the value for 'Inclusion Setting', and write only that value (e.g., 'Success and Failure', 'Success', 'No Auditing') to standard output.

## Remediation Script Working

PowerShell script that accepts a single string argument specifying the desired audit level ('Success and Failure', 'Success', 'Failure', 'No Auditing'). The script must use `auditpol.exe` to configure the 'System Integrity' subcategory accordingly. For 'Success and Failure', it should run `auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable`. It must return `$true` on successful execution and `$false` on failure.

