# Ensure 'Audit Process Creation' is set to include 'Success'

Necessity: Enabling the 'Audit Process Creation' policy is critical for security monitoring and incident response. It generates a security log event (Event ID 4688) each time a new process is started, providing details such as the process name and the parent process that created it. This data is invaluable for detecting malware execution, tracking unauthorized software, and analyzing an attacker's lateral movement across a network. Without this auditing, investigators have a significant blind spot when trying to reconstruct the timeline of a security breach.

Auditing and Remediation: The audit script leverages the 'auditpol.exe' utility to read the current audit configuration for the 'Process Creation' subcategory within the 'Detailed Tracking' category. The remediation script uses the same utility with the '/set' parameter to apply the desired auditing level ('Success', 'Failure', or both), modifying the system's security policy.

Recommended State Rationale:
- Basic: ['Success'] - This state meets the minimum requirement for security visibility by logging every process that is successfully launched. It provides a fundamental baseline for monitoring system activity and is recommended by benchmarks like CIS.
- Moderate: ['Success and Failure'] - This state provides a more comprehensive security posture by also logging failed attempts to create a process. These failure events can indicate malicious activity, such as malware trying to execute a payload that is blocked by security controls or an attacker attempting to run tools with insufficient privileges.
- Strict: ['Success and Failure'] - This is the most robust configuration available for this setting. It provides complete visibility into all process creation attempts, both successful and failed. This level is essential for high-security environments and systems subject to rigorous compliance and forensic requirements, as it leaves no gaps in process activity logging. For this specific policy, the moderate and strict recommendations are identical as they represent the highest level of detail available.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Success']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the system's advanced audit policy for the 'Process Creation' subcategory. The script must use the 'auditpol.exe' command, parse its output, and return only the current setting (e.g., 'No Auditing', 'Success', 'Failure', 'Success and Failure').

## Remediation Script Working

PowerShell script that configures the 'Audit Process Creation' setting. The script must accept a single positional command-line argument specifying the desired state ('Success', 'Failure', 'Success and Failure', or 'No Auditing'). It must use 'auditpol.exe' to apply the new configuration and return '$true' on success or '$false' on failure.

