# Ensure 'Audit PNP Activity' is set to include

Necessity: Auditing Plug and Play (PNP) activity is crucial for detecting the installation of hardware on a system. This is a critical security control to mitigate threats from unauthorized or malicious hardware, such as USB-based attack tools (e.g., Rubber Ducky). A lack of auditing in this area creates a significant blind spot, preventing administrators from detecting physical security breaches or the introduction of compromised devices. 

Auditing and Remediation: The audit script queries the system's advanced audit policy using the 'auditpol.exe' utility to determine the current auditing level for the 'PNP Activity' subcategory. The remediation script uses the same utility to set the auditing policy to the desired state (e.g., for success, failure, or both), based on the value passed as a command-line argument. 

Recommended State Rationale: 
- Basic: ['Success'] - This level logs an event every time a plug-and-play device is successfully installed. It serves as a minimum baseline for tracking hardware changes on the system. 
- Moderate: ['Success and Failure'] - This is the generally recommended state. It logs both successful device installations and failed attempts. Failed attempts are important to investigate as they could indicate faulty hardware, driver compatibility issues, or an adversary attempting to connect an unsupported or malicious device. 
- Strict: ['Success and Failure'] - This state is identical to Moderate because it represents the most comprehensive auditing level available for this setting. Capturing both outcomes provides the complete visibility required for robust security monitoring and incident response related to hardware changes.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Success']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that executes 'auditpol /get /subcategory:"PNP Activity"' and parses the output. The script must return only the value of the 'Inclusion Setting' (e.g., 'No Auditing', 'Success', 'Failure', 'Success and Failure') with no additional text or labels.

## Remediation Script Working

PowerShell script that accepts a single positional string argument. The argument will be one of the following: 'No Auditing', 'Success', 'Failure', or 'Success and Failure'. The script must configure the 'PNP Activity' audit policy accordingly using 'auditpol.exe /set'. For 'Success and Failure', it should run '/success:enable /failure:enable'. For 'Success', it should run '/success:enable /failure:disable'. For 'Failure', it should run '/success:disable /failure:enable'. For 'No Auditing', it should run '/success:disable /failure:disable'. The script must return $true on success and $false on failure.

