# Ensure 'Audit Credential Validation' is set to 'Success and Failure'

Necessity: Auditing credential validation is critical for security monitoring. It generates event logs for every attempt to validate user credentials for a logon request. This is essential for detecting credential-based attacks such as brute-force attempts, password spraying, and credential stuffing (indicated by a high volume of failure events), as well as identifying unauthorized successful logons that could signify a compromised account. Without this auditing, an organization has a significant blind spot and cannot effectively investigate or respond to security incidents involving account access.\n\nAuditing and Remediation: The audit script queries the system's current advanced audit policy for the 'Credential Validation' subcategory using the 'auditpol.exe' utility. The remediation script uses the same utility ('auditpol.exe /set') to modify the live policy, enabling or disabling auditing for success and failure events based on the provided input argument.\n\nRecommended State Rationale: The Basic, Moderate, and Strict levels all recommend 'Success and Failure'. This is because, for this specific control, a partial setting is insufficient for comprehensive security. Basic: Auditing both successes and failures is the minimum baseline required by security frameworks like CIS. Failures are crucial for detecting attack attempts, while successes are necessary for tracing an attacker's activity post-breach. Moderate/Strict: There is no more secure or granular state than 'Success and Failure'. This setting provides the complete picture needed for effective threat detection and incident response, making it the universal recommendation for all hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Success and Failure']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the current setting for the 'Credential Validation' audit policy. The script must parse the output of 'auditpol /get /subcategory:"Credential Validation"' and return only the current inclusion setting (e.g., 'Success and Failure', 'Success', 'Failure', or 'No Auditing').

## Remediation Script Working

PowerShell script that configures the 'Credential Validation' audit policy. The script must accept one positional command-line argument representing the desired state ('Success and Failure', 'Success', 'Failure', 'No Auditing'). It will use 'auditpol.exe' to apply the setting and must return '$true' if the operation succeeds or '$false' if it fails.

