# Ensure 'Audit Account Lockout' is set to include 'Failure'

Necessity: Auditing account lockout events is a critical security measure for detecting potential brute-force or password spraying attacks against user accounts. When an account is locked out, it signifies that a threshold of incorrect password attempts has been exceeded. Logging these failure events provides a clear, actionable indicator for security monitoring systems (SIEM) and incident responders to investigate and mitigate potential intrusions. Failure to audit these events creates a significant blind spot, allowing attackers to attempt to compromise accounts without detection.

Auditing and Remediation: The audit script queries the system's advanced audit policy configuration using the 'auditpol.exe' utility to determine the current setting for the 'Account Lockout' subcategory. The remediation script uses the same utility to set the audit policy, enabling or disabling auditing for success and failure events based on the provided parameter.

Recommended State Rationale:
- Basic: ['Failure'] - This state meets the minimum security requirement by ensuring that an event is generated when an account is locked out. This is the most crucial signal for identifying a potential brute-force attack in progress.
- Moderate: ['Success and Failure'] - This is the widely recommended best practice (e.g., by CIS Benchmarks). In addition to logging the lockout (failure), it also logs when the lockout counter is reset after a successful logon. This provides a more complete audit trail for forensic analysis.
- Strict: ['Success and Failure'] - For this specific policy, auditing both success and failure is the most comprehensive and secure configuration possible. There is no state stricter than this, as it captures all relevant events related to the account lockout mechanism. Therefore, the Strict recommendation is identical to the Moderate one.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Failure']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that uses the 'auditpol.exe' command to retrieve the current audit setting for the 'Account Lockout' subcategory. The script must parse the output and return only the current setting value (e.g., 'No Auditing', 'Success', 'Failure', 'Success and Failure') as a string, with no additional text or formatting.

## Remediation Script Working

PowerShell script that accepts a single string argument specifying the desired audit setting ('No Auditing', 'Success', 'Failure', or 'Success and Failure'). The script must use 'auditpol.exe' to configure the 'Account Lockout' audit policy accordingly. It must return the boolean value '$true' upon successful application of the setting, and '$false' if the operation fails or the input is invalid.

