# Ensure 'Audit Credential Validation' is set to 'Success and Failure'

Necessity: Auditing credential validation is crucial for security monitoring as it records every attempt to use credentials for a logon, whether it succeeds or fails. This event log is a primary source for detecting security threats such as brute-force attacks (indicated by a high volume of failures), password spraying, and successful unauthorized access. Failing to audit both success and failure creates significant blind spots, making it difficult to investigate security incidents or identify compromised accounts in a timely manner. 

Auditing and Remediation: The audit script queries the system's advanced audit policy configuration using the built-in 'auditpol.exe' command-line tool to determine the current auditing level for the 'Credential Validation' subcategory. The remediation script uses the same tool to set the policy, enabling or disabling auditing for success and failure events based on the provided input. 

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Success and Failure'. This is because any less comprehensive setting is insufficient for robust security monitoring. Basic security requires visibility into both successful and failed logons to establish a baseline and detect anomalies. For Moderate and Strict environments, this level of logging is non-negotiable and foundational for any Security Information and Event Management (SIEM) system or incident response plan. There is no more secure or 'stricter' setting than capturing all outcomes.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Success and Failure']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the 'Credential Validation' audit policy setting. The script must use 'auditpol.exe /get /subcategory:"Credential Validation"' and parse the output to return only the current value of the 'Inclusion Setting', which will be one of the following strings: 'No Auditing', 'Success', 'Failure', or 'Success and Failure'.

## Remediation Script Working

PowerShell script that accepts a single, positional command-line argument which must be one of the following strings: 'Success and Failure', 'Success', 'Failure', or 'No Auditing'. The script will use 'auditpol.exe /set' to configure the 'Credential Validation' subcategory according to the argument (e.g., for 'Success and Failure', it would set both success and failure to 'enable'). The script must return '$true' on successful application of the setting and '$false' on failure.

