# Ensure 'Audit Security Group Management' is set to include 'Success'

Necessity: Auditing security group management is critical for tracking changes to security groups, which are a cornerstone of access control in Windows environments. This includes the creation, modification, or deletion of security groups and changes to group membership. Without this auditing, an attacker could add a user to a privileged group (privilege escalation) or remove critical accounts, and the action would not be logged, severely hindering incident detection and forensic analysis. Misconfiguration creates a significant blind spot in the security posture. 

Auditing and Remediation: The audit script queries the system's current advanced audit policy for the 'Security Group Management' subcategory using the 'auditpol.exe' utility and reports the configured setting. The remediation script uses the same utility to set the audit policy to track success, failure, or both, based on the provided state. 

Recommended State Rationale: 
- Basic: ['Success'] - This level ensures that all successful changes to security groups are logged. This is the minimum requirement to have an audit trail of who made what changes and when, which is essential for compliance and basic forensic investigation. 
- Moderate: ['Success and Failure'] - This is a more robust configuration. In addition to successful events, it logs failed attempts to modify security groups. This is crucial for security monitoring as it can indicate an unauthorized user or malicious process attempting to escalate privileges or disrupt services. 
- Strict: ['Success and Failure'] - This is the highest level of logging for this category and is considered a best practice. It provides the most comprehensive view of activity related to security groups, capturing both legitimate changes and potential malicious attempts, which is vital for a mature security operations program.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Success']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that uses the 'auditpol.exe /get /subcategory:"Security Group Management" /r' command. The script must parse the CSV output and return only the value of the 'Inclusion Setting' field, such as 'Success and Failure', 'Success', 'Failure', or 'No Auditing'.

## Remediation Script Working

PowerShell script that accepts a single string argument specifying the desired state ('Success', 'Failure', 'Success and Failure', or 'No Auditing'). The script must use 'auditpol.exe' to set the 'Security Group Management' subcategory policy. For example, if the argument is 'Success', it should execute '/success:enable /failure:disable'. The script must return '$true' upon successful application of the setting and '$false' on failure.

