# Ensure 'Audit System Integrity' is set to 'Success and Failure'

The 'Audit System Integrity' policy setting determines whether the operating system audits events that violate the integrity of the security subsystem. This includes events such as the initialization of the Security Account Manager (SAM) and other critical system services. Auditing these events is crucial for detecting attempts to tamper with or compromise core OS security components. Misconfiguration creates a significant blind spot, preventing administrators from detecting malicious activity targeting the system's foundational security mechanisms. The audit script checks the current configuration using 'auditpol.exe', while the remediation script uses the same tool to set the policy for success and failure events. The recommended state for all hardening levels is 'Success and Failure' because it provides the most comprehensive security posture. Auditing successes confirms that critical security services are starting as expected, while auditing failures is essential for identifying unauthorized attempts to compromise or disable these services. Anything less than full auditing is insufficient for a secure environment.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Success and Failure']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that executes 'auditpol.exe /get /subcategory:"System Integrity"'. The script must parse the output to find the value associated with the 'Setting' and return only this value (e.g., 'Success and Failure', 'No Auditing').

## Remediation Script Working

PowerShell script that accepts a single positional string argument. The script must map the argument to the appropriate auditpol settings: 'Success and Failure' (/success:enable /failure:enable), 'Success' (/success:enable /failure:disable), 'Failure' (/success:disable /failure:enable), 'No Auditing' (/success:disable /failure:disable). It will then execute 'auditpol.exe /set /subcategory:"System Integrity"' with the corresponding flags. The script must return $true if the command executes successfully, and $false otherwise.

