# Ensure 'Audit Sensitive Privilege Use' is set to 'Success and Failure'

Necessity: Auditing sensitive privilege use is critical for tracking the exercise of powerful user rights, such as 'Take ownership of files or other objects' or 'Act as part of the operating system.' An attacker who gains access to an account with these privileges can escalate their control, access sensitive data, or install malicious software. Failure to log these events creates a significant blind spot, preventing the detection of privilege abuse and hindering forensic investigations. Auditing provides a crucial trail for identifying unauthorized activity.

Auditing and Remediation: The audit script uses the native Windows 'auditpol.exe' utility to query the current policy for the 'Sensitive Privilege Use' subcategory and returns its status. The remediation script uses the same utility to set the policy, enabling auditing for successful attempts, failed attempts, or both, based on the provided argument.

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is 'Success and Failure'. This is the most comprehensive and secure configuration. Basic requires this setting because even a baseline security posture must account for both successful exploitation and failed attempts, which can indicate an ongoing attack. Moderate and Strict levels do not change because there is no more secure option for this specific control. Auditing 'Success' is essential to detect when a powerful privilege was actually used, while auditing 'Failure' is crucial for identifying attempts to escalate privileges, which can be an early indicator of a compromise.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Success and Failure']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that executes 'auditpol /get /subcategory:"Sensitive Privilege Use"'. The script must parse the output and return only the current value for the 'Inclusion Setting' (e.g., 'Success and Failure', 'No Auditing'). No other text or labels should be returned.

## Remediation Script Working

PowerShell script that accepts a single string value as a positional command-line argument. The accepted values are 'Success and Failure', 'Success', 'Failure', or 'No Auditing'. The script will configure the 'Sensitive Privilege Use' audit policy accordingly using 'auditpol.exe'. For example, if the argument is 'Success and Failure', it should run 'auditpol /set /subcategory:"Sensitive Privilege Use" /success:enable /failure:enable'. The script must return $true on successful application of the setting and $false on failure.

