# Ensure 'Audit Security Group Management' is set to include 'Success'

Necessity: Auditing security group management is critical for monitoring changes to user rights and permissions. It tracks events such as the creation, modification, or deletion of security groups, and the addition or removal of members. Failure to audit these events can allow privilege escalation attacks to go undetected, where an attacker might add a compromised account to an administrative group (e.g., Domain Admins). This setting is essential for maintaining accountability and enabling forensic investigation after a security incident. Auditing and Remediation: The audit script reads the current configuration for the 'Security Group Management' subcategory using the 'auditpol' utility. The remediation script uses the same utility to set the auditing level for success and/or failure events based on a provided command-line argument. Recommended State Rationale: Basic: ['Success'] - This level ensures that all successful changes to security groups are logged. It provides a fundamental audit trail for accountability and change tracking. Moderate & Strict: ['Success and Failure'] - This is the highest recommended state. In addition to logging successful changes, it also logs failed attempts. Failed attempts can be a strong indicator of malicious activity, such as a non-privileged user trying to add themselves to a sensitive group. Logging both provides a complete picture of administrative activity and potential security threats, which is a requirement for both moderate and strict security postures.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Success']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the 'Security Group Management' advanced audit policy subcategory. The script must parse the output of 'auditpol /get /subcategory:"Security Group Management"' to return only the current auditing level string (e.g., 'No Auditing', 'Success', 'Failure', 'Success and Failure'), with no extra text or labels.

## Remediation Script Working

PowerShell script that accepts a single positional string argument from the following set: 'No Auditing', 'Success', 'Failure', 'Success and Failure'. The script must use 'auditpol /set' to configure the 'Security Group Management' subcategory to match the provided state. The script must return $true on successful application of the policy and $false on failure.

