# Ensure 'Allow auditing events in Microsoft Defender Application Guard' is set to 'Enabled'

Necessity: Microsoft Defender Application Guard isolates untrusted sites and files in a lightweight virtualized container to protect the host OS from malware. Enabling auditing for Application Guard is critical for security visibility. It logs events generated from within the isolated container, such as attempts to access host resources or other suspicious activities. Without auditing, an attacker could attempt to exploit a vulnerability or escape the container without leaving a trace on the host system's logs, creating a significant security blind spot and hindering incident response and forensic analysis.

Auditing and Remediation: The audit script checks the registry value at 'HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI\AuditApplicationGuard' to determine if the policy is enabled ('1') or disabled ('0' or not configured). The remediation script directly modifies this registry value, creating the key and value if necessary, to enforce the desired state based on the provided input.

Recommended State Rationale: 
- Basic: 'Enabled'. Enabling auditing is the fundamental requirement for monitoring Application Guard's security effectiveness. 
- Moderate: 'Enabled'. As this is a binary setting (either on or off), the moderate state is the same as the basic state. There is no intermediate configuration.
- Strict: 'Enabled'. For a strict security posture, comprehensive logging and visibility are non-negotiable. Enabling this feature is the only secure option, as disabling it offers no benefit and only increases risk by obscuring potential threat activity.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the DWORD value 'AuditApplicationGuard' at the registry path 'HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI'. If the value data is '1', the script must return '1'. In all other cases, including if the path or value does not exist, it must return '0'. The output must only be the final value with no extra text or formatting.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument ('1' for Enabled, '0' for Disabled). The script must configure the 'AuditApplicationGuard' DWORD value at 'HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI'. It must create the registry path if it does not exist. If the argument is '1', the value should be set to '1'. If the argument is '0', the value should be set to '0'. The script must return '$true' on successful configuration and '$false' on failure.

