# Ensure 'Audit Other Logon/Logoff Events' is set to 'Success and Failure'

Necessity: Enabling auditing for 'Other Logon/Logoff Events' is critical for monitoring user activity and detecting potential security threats. This policy logs events such as remote desktop connections and disconnections, workstation locking and unlocking, and processes run via the 'runas' command. Without this auditing, an organization would have significant blind spots regarding lateral movement, privilege escalation, and user session activity, making it difficult to investigate security incidents or detect unauthorized access in real-time. A misconfiguration leaves a gap in the security audit trail that attackers can exploit.

Auditing and Remediation: The audit script leverages the Windows command-line tool `auditpol.exe` to query the current audit policy setting for the 'Other Logon/Logoff Events' subcategory. The remediation script uses the same tool (`auditpol.exe /set`) to modify the system's configuration to match the desired state passed as an argument, enabling or disabling auditing for success and failure events as specified.

Recommended State Rationale: The recommended state for all levels—Basic, Moderate, and Strict—is 'Success and Failure'. This is because there is no more secure setting for this specific policy. Basic: Logging both successful and failed events is the minimum standard for effective security monitoring, as recommended by benchmarks like CIS. Success logs help create a baseline of normal activity, while failure logs can be early indicators of attacks, such as brute-force attempts on Remote Desktop Protocol (RDP). Moderate/Strict: For this particular setting, any configuration other than 'Success and Failure' represents a reduction in security visibility. Therefore, the most secure and comprehensive configuration is maintained across all hardening levels to ensure a complete audit trail.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Success and Failure']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that executes `auditpol.exe /get /subcategory:"Other Logon/Logoff Events"` and parses the output to return only the current 'Inclusion Setting' value (e.g., 'No Auditing', 'Success', 'Failure', 'Success and Failure').

## Remediation Script Working

PowerShell script that accepts a single positional string argument specifying the desired audit level ('No Auditing', 'Success', 'Failure', 'Success and Failure'). The script must use `auditpol.exe /set` to configure the 'Other Logon/Logoff Events' subcategory accordingly. It must return `$true` if the command succeeds and `$false` otherwise.

