# Ensure 'Audit User Account Management' is set to 'Success and Failure'

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Success and Failure']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the current setting for the 'User Account Management' advanced audit policy. The script must parse the output of `auditpol /get /subcategory:\"User Account Management\"` to isolate and return only the configured value (e.g., 'Success and Failure', 'Success', 'Failure', 'No Auditing'), with no additional text or labels.

## Remediation Script Working

PowerShell script that configures the 'User Account Management' advanced audit policy. The script must accept a single positional command-line argument which can be 'Success and Failure', 'Success', 'Failure', or 'No Auditing'. Based on this argument, it will execute the appropriate `auditpol /set` command with the correct `/success` and `/failure` switches. The script must return `$true` if the command succeeds and `$false` if it fails

