# Ensure 'Audit Audit Policy Change' is set to include 'Success'

Necessity: Auditing policy changes is a critical security function for maintaining the integrity of an operating system's security configuration. This setting tracks any modifications made to important security policies, including audit policies, user rights assignments, and trust relationships. Monitoring these changes helps detect unauthorized administrative activity, potential security breaches, or insider threats attempting to weaken system defenses or cover their tracks. Without this auditing, an attacker could alter security settings without leaving a clear trail, significantly hindering incident response and forensic analysis.

Auditing and Remediation: The audit script uses the native `auditpol.exe` utility to query the current inclusion setting for the 'Policy Change' subcategory and reports the result. The remediation script uses the same utility to set the audit configuration for this subcategory, enabling or disabling auditing for success and failure events based on the provided command-line argument.

Recommended State Rationale:
- Basic: `['Success']`. This state meets the minimum requirement for most security benchmarks. It logs every successful change to security policies, providing a clear record of when and by whom configurations were altered. This is essential for change management and accountability.
- Moderate: `['Success and Failure']`. This is the recommended state for most production environments. In addition to logging successful changes, it also logs failed attempts. Monitoring failed attempts is crucial for identifying potential attacks, such as an unauthorized user or malicious process trying to escalate privileges or disable security controls but being denied by the system.
- Strict: `['Success and Failure']`. This is the most secure configuration. For this particular setting, there is no higher level of logging than capturing both successful and failed events. It provides the most comprehensive visibility into activities surrounding security policy management, which is vital for high-security environments.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Success']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the current audit setting for the 'Policy Change' subcategory. The script should use the `auditpol.exe` command, parse its CSV output, and return only the string value of the 'Inclusion Setting' (e.g., 'No Auditing', 'Success', 'Failure', 'Success and Failure').

## Remediation Script Working

PowerShell script that configures the audit setting for the 'Policy Change' subcategory. The script must accept a single positional command-line argument representing the desired state ('Success', 'Failure', 'Success and Failure', 'No Auditing'). It will use `auditpol.exe` to apply the setting and must return `$true` upon successful execution or `$false` if it fails or receives an invalid argument.

