# Ensure 'Audit Application Group Management' is set to 'Success and Failure'

Necessity: Auditing Application Group Management is crucial for tracking changes to groups that control access to applications and resources. This includes the creation, deletion, modification, and membership changes of these groups. Failure to audit these events creates a significant blind spot, allowing unauthorized privilege escalation or access changes to go undetected, which could lead to data breaches or system compromise. Monitoring both successful and failed events helps detect reconnaissance activities and unauthorized access attempts.

Auditing and Remediation: The audit script queries the system's current advanced audit policy for the 'Application Group Management' subcategory using the `auditpol.exe` utility. The remediation script uses the same utility to set the audit policy, enabling or disabling auditing for success and failure events based on the provided command-line argument.

Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is 'Success and Failure'. This is the security best practice as it provides the most comprehensive visibility. 'Success' auditing logs all successful changes, which is vital for change management and incident forensics to understand what actions an attacker performed. 'Failure' auditing is critical for detecting active threats, as it logs failed attempts to modify group memberships or permissions, which often indicates an adversary attempting to escalate privileges. There is no more secure setting available, making this the universal recommendation.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Success and Failure']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that uses `auditpol.exe` to retrieve the current inclusion setting for the 'Application Group Management' subcategory. The script must parse the output and return only the setting value, such as 'No Auditing', 'Success', 'Failure', or 'Success and Failure', with no extra text or labels.

## Remediation Script Working

PowerShell script that configures the 'Audit Application Group Management' subcategory setting. The script must accept a single positional command-line argument specifying the desired state ('No Auditing', 'Success', 'Failure', or 'Success and Failure'). It will then use `auditpol.exe` to apply the corresponding switches (e.g., /success:enable, /failure:enable). The script must return `$true` if the configuration is successful and `$false` if it fails.

