# Ensure 'Audit Audit Policy Change' is set to include 'Success'

Necessity: Auditing changes to the audit policy is a critical security measure. It creates a log of any modification made to the system's auditing configuration. An attacker who gains administrative privileges may attempt to disable auditing to hide their activities. Logging successful changes ensures a trail exists for forensic analysis. Logging failed attempts can provide an early warning of an adversary attempting to tamper with security controls. Failure to audit these events creates a significant blind spot, undermining the integrity of the entire security logging and monitoring system.

Auditing and Remediation: The audit script leverages the native Windows 'auditpol.exe' command-line tool to query the current audit setting for the 'Audit Policy Change' subcategory. The remediation script uses the same tool to set the audit configuration for success and/or failure events, based on the provided input.

Recommended State Rationale:
- Basic: ['Success'] - This state meets the minimum security requirement by logging all successful modifications to the audit policy. This ensures that any change, whether authorized or malicious, is recorded.
- Moderate: ['Success and Failure'] - This state provides a more comprehensive security posture by logging both successful changes and failed attempts. Logging failures is crucial as it can indicate an attacker attempting to disable security controls before they have sufficient privileges, acting as an early indicator of compromise.
- Strict: ['Success and Failure'] - This is the highest level of auditing for this setting and is considered the best practice. There is no more granular level of logging available, so the Strict recommendation is identical to Moderate, providing maximum visibility into attempts to manipulate the system's audit integrity.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Success']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that uses the 'auditpol /get /subcategory:"Audit Policy Change"' command. The script must parse the output to determine the currently configured auditing level and return only the resulting string value, which will be one of the following: 'No Auditing', 'Success', 'Failure', or 'Success and Failure'.

## Remediation Script Working

PowerShell script that accepts a single positional string argument representing the desired audit state ('No Auditing', 'Success', 'Failure', 'Success and Failure'). The script must use the 'auditpol /set /subcategory:"Audit Policy Change"' command with the appropriate '/success' and '/failure' flags based on the input. The script must return $true upon successful execution or $false if an error occurs.

