# Ensure 'Audit PNP Activity' is set to include

Necessity: Auditing Plug and Play (PNP) activity is crucial for tracking the connection of external devices, such as USB drives. This helps detect unauthorized hardware additions which could be used to exfiltrate data or introduce malware. Misconfiguration of this setting creates a significant security blind spot, allowing physical-level attacks to go unnoticed. Auditing and Remediation: The audit script uses the 'auditpol.exe' utility to retrieve the current inclusion setting for the 'PNP Activity' policy subcategory. The remediation script uses the same utility to set the auditing policy for success and/or failure events based on the desired state. Recommended State Rationale: Basic: ['Success'] - This level logs all successful connections of external hardware. It establishes a baseline of normal activity and is essential for identifying when new, potentially unauthorized, devices are introduced. Moderate: ['Success and Failure'] - This state improves visibility by also logging failed attempts to connect hardware. Failed events can indicate malfunctioning equipment or an adversary attempting to use a malicious or incompatible device, providing a more complete forensic trail. Strict: ['Success and Failure'] - The strictest and most comprehensive configuration is to audit both successful and failed events. This provides maximum visibility into all hardware plug-and-play activities, which is critical in high-security environments where physical device threats are a primary concern.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Success']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the Advanced Audit Policy for the 'PNP Activity' subcategory. The script must parse the output of `auditpol /get /subcategory:"PNP Activity"` and return only the current 'Inclusion Setting' value (e.g., 'No Auditing', 'Success', 'Failure', 'Success and Failure').

## Remediation Script Working

PowerShell script that configures the 'Audit PNP Activity' setting. The script must accept a single positional command-line argument specifying the desired state ('Success', 'Success and Failure', 'No Auditing'). Based on the input, it will execute the appropriate `auditpol /set` command (e.g., `/success:enable`, `/failure:enable`). The script must return `$true` upon successful application of the setting and `$false` otherwise.

