# Ensure 'Audit Account Lockout' is set to include 'Failure'

Necessity: Auditing account lockouts is a critical security measure for detecting brute-force password attacks. When an attacker repeatedly tries to guess a user's password, the account will eventually be locked out based on the account lockout policy. This setting ensures that an event is logged whenever an account is locked out, providing a clear indicator of a potential attack. Without this auditing, an organization would have a significant blind spot, allowing attackers to attempt credential compromise without generating detectable security alerts.

Auditing and Remediation: The audit script uses the Windows command-line tool `auditpol.exe` to query the current audit policy for the 'Account Lockout' subcategory and returns the configured setting. The remediation script uses the same tool to set the audit policy for this subcategory, enabling or disabling auditing for 'Success' and 'Failure' events based on the provided input.

Recommended State Rationale:
- Basic: `['Failure', 'Success and Failure']`. This state ensures that, at a minimum, events related to lockout policy failures are logged, which aligns with the request to include 'Failure' auditing. This provides a baseline level of visibility into attacks.
- Moderate: `['Success and Failure']`. This state aligns with security best practices, such as the CIS Benchmarks. It configures the system to log both success and failure events. The primary event, an account being locked out (Event ID 4740), is a 'Success' audit. Logging both provides the most comprehensive data for investigating potential security incidents.
- Strict: `['Success and Failure']`. This is the most secure and recommended configuration. It provides a complete audit trail for all events governed by this policy subcategory. As there is no more granular or stringent setting available, the Strict recommendation is the same as Moderate, representing the highest level of logging for this control.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Failure', 'Success and Failure']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that uses `auditpol.exe` to retrieve the current setting for the 'Account Lockout' subcategory. The script must parse the output and return only the current value (e.g., 'No Auditing', 'Success', 'Failure', or 'Success and Failure'), with no additional text or formatting.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument specifying the desired audit state ('No Auditing', 'Success', 'Failure', 'Success and Failure'). The script must use `auditpol.exe` to configure the 'Account Lockout' audit policy to the specified state. It must return `$true` if the configuration is successful and `$false` otherwise.

