# Ensure 'Audit File Share' is set to 'Success and Failure'

Necessity: Auditing file share access is crucial for monitoring and detecting unauthorized attempts to access, modify, or delete data stored on network shares. This setting helps create a detailed log of all interactions with shared files and folders, which is essential for forensic investigations, incident response, and compliance with data protection regulations. Without it, malicious activity such as data exfiltration or ransomware staging could go unnoticed. 

Auditing and Remediation: The audit script queries the system's advanced audit policy configuration using the 'auditpol.exe' utility to determine the current logging level for the 'File Share' subcategory. The remediation script uses the same utility to set the auditing level for both successful and failed access attempts based on the provided input. 

Recommended State Rationale: 
- Basic: ['Success and Failure']. This is the minimum recommended state. Auditing successes tracks all access to shared resources, helping to identify unusual patterns or data exfiltration by insiders. Auditing failures is critical for identifying external threats, such as attackers scanning for open shares or attempting to access resources without proper permissions. 
- Moderate: ['Success and Failure']. For this control, a moderate state is identical to the basic state because partial auditing (e.g., only 'Success') creates significant security blind spots. Comprehensive visibility is required for effective security monitoring. 
- Strict: ['Success and Failure']. The strictest and most secure configuration is to audit both outcomes. This provides a complete forensic trail of all activity related to file shares, which is a best practice recommended by security frameworks like the CIS Benchmarks. There is no more secure level for this particular setting.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Success and Failure']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that uses 'auditpol.exe /get /subcategory:"File Share"' to retrieve the current audit policy setting. The script must parse the output and return only the configuration state (e.g., 'Success and Failure', 'Success', 'Failure', 'No Auditing') as a single string.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument specifying the desired state ('Success and Failure', 'Success', 'Failure', or 'No Auditing'). The script will use 'auditpol.exe /set' to configure the 'File Share' audit subcategory accordingly. It must return '$true' on success and '$false' on failure.

