---
title: CIS Windows 11 Advanced Audit Policy Configuration | Wartiva
description: Wartiva's 27 checks for section 17, Advanced Audit Policy Configuration, of the CIS Microsoft Windows 11 Stand-alone Benchmark, with rationale and remediation.
url: https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html
updated: 2026-10-07
---

CIS Microsoft Windows 11 Stand-alone Benchmark · Section 17

# Windows 11 Advanced Audit Policy Configuration: 27 Checks

Wartiva runs 27 checks for section 17, Advanced Audit Policy Configuration, of the CIS Microsoft Windows 11 Stand-alone Benchmark. Each one lists what it finds, why it matters, and how to fix it.

Wartiva evaluates these checks on its cloud mirror every time an endpoint changes, with zero endpoint load, and turns every failure into a finding with captured evidence. [How Wartiva works →](https://wartiva.com/platform.html)

## 17.1 Account Logon

### [Ensure Credential Validation Auditing Is Set To Success And Failure](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#credential-validation-auditing-is-set-to-success-and-failure)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.1

**Finding:** Credential Validation auditing does not cover the required outcomes.

Audits the results of validation tests on credentials submitted for an account logon request, recorded on the machine authoritative for the credentials.

This rule fails when `credentialValidation` is not `SUCCESS_AND_FAILURE`.

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Logon\Audit Credential Validation** to **Success and Failure**.

From the command line:

```powershell
auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

## 17.2 Account Management

### [Ensure Application Group Management Auditing Is Set To Success And Failure](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#application-group-management-auditing-is-set-to-success-and-failure)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.2

**Finding:** Application Group Management auditing does not cover the required outcomes.

Audits creation, modification, deletion, and membership changes of application groups used by Windows Authorization Manager.

This rule fails when `applicationGroupManagement` is not `SUCCESS_AND_FAILURE`.

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit Application Group Management** to **Success and Failure**.

From the command line:

```powershell
auditpol /set /subcategory:"Application Group Management" /success:enable /failure:enable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

### [Ensure Security Group Management Auditing Is Set To Include Success](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#security-group-management-auditing-is-set-to-include-success)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.2

**Finding:** Security Group Management auditing does not include Success.

Audits security group management, including when a security group is created, changed, or deleted and when a member is added to or removed from a security group.

This rule fails when `securityGroupManagement` does not include `SUCCESS` (must be `SUCCESS` or `SUCCESS_AND_FAILURE`).

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit Security Group Management** to include **Success**.

From the command line:

```powershell
auditpol /set /subcategory:"Security Group Management" /success:enable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

### [Ensure User Account Management Auditing Is Set To Success And Failure](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#user-account-management-auditing-is-set-to-success-and-failure)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.2

**Finding:** User Account Management auditing does not cover the required outcomes.

Audits user account management, including creation, change, deletion, rename, enable/disable, and password set or change operations.

This rule fails when `userAccountManagement` is not `SUCCESS_AND_FAILURE`.

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit User Account Management** to **Success and Failure**.

From the command line:

```powershell
auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

## 17.3 Detailed Tracking

### [Ensure PNP Activity Auditing Is Set To Include Success](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#pnp-activity-auditing-is-set-to-include-success)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.3

**Finding:** PNP Activity auditing does not include Success.

Audits when Plug and Play detects that an external device is connected to the system.

This rule fails when `plugAndPlayEvents` does not include `SUCCESS` (must be `SUCCESS` or `SUCCESS_AND_FAILURE`).

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Detailed Tracking\Audit PNP Activity** to include **Success**.

From the command line:

```powershell
auditpol /set /subcategory:"PNP Activity" /success:enable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

### [Ensure Process Creation Auditing Is Set To Include Success](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#process-creation-auditing-is-set-to-include-success)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.3

**Finding:** Process Creation auditing does not include Success.

Audits the creation of a process, recording the program and the user or program that created it.

This rule fails when `processCreation` does not include `SUCCESS` (must be `SUCCESS` or `SUCCESS_AND_FAILURE`).

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Detailed Tracking\Audit Process Creation** to include **Success**.

From the command line:

```powershell
auditpol /set /subcategory:"Process Creation" /success:enable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

## 17.5 Logon/Logoff

### [Ensure Account Lockout Auditing Is Set To Include Failure](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#account-lockout-auditing-is-set-to-include-failure)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.5

**Finding:** Account Lockout auditing does not include Failure.

Audits when a user account is locked out after too many failed logon attempts.

This rule fails when `accountLockout` does not include `FAILURE` (must be `FAILURE` or `SUCCESS_AND_FAILURE`).

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Account Lockout** to include **Failure**.

From the command line:

```powershell
auditpol /set /subcategory:"Account Lockout" /failure:enable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

### [Ensure Group Membership Auditing Is Set To Include Success](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#group-membership-auditing-is-set-to-include-success)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.5

**Finding:** Group Membership auditing does not include Success.

Audits the group membership information contained in a user's logon token, generated on the machine where the logon session is created.

This rule fails when `groupMembership` does not include `SUCCESS` (must be `SUCCESS` or `SUCCESS_AND_FAILURE`).

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Group Membership** to include **Success**.

From the command line:

```powershell
auditpol /set /subcategory:"Group Membership" /success:enable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

### [Ensure Logoff Auditing Is Set To Include Success](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#logoff-auditing-is-set-to-include-success)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.5

**Finding:** Logoff auditing does not include Success.

Audits when a user logs off from the system, recorded on the accessed computer.

This rule fails when `logoff` does not include `SUCCESS` (must be `SUCCESS` or `SUCCESS_AND_FAILURE`).

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Logoff** to include **Success**.

From the command line:

```powershell
auditpol /set /subcategory:"Logoff" /success:enable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

### [Ensure Logon Auditing Is Set To Success And Failure](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#logon-auditing-is-set-to-success-and-failure)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.5

**Finding:** Logon auditing does not cover the required outcomes.

Audits each attempt by a user to log on to the system, recorded on the accessed computer.

This rule fails when `logon` is not `SUCCESS_AND_FAILURE`.

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Logon** to **Success and Failure**.

From the command line:

```powershell
auditpol /set /subcategory:"Logon" /success:enable /failure:enable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

### [Ensure Other Logon/Logoff Events Auditing Is Set To Success And Failure](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#other-logon-logoff-events-auditing-is-set-to-success-and-failure)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.5

**Finding:** Other Logon/Logoff Events auditing does not cover the required outcomes.

Audits other logon/logoff-related events such as Remote Desktop session disconnects and reconnects, RunAs usage, and workstation locking and unlocking.

This rule fails when `otherLogonLogoffEvents` is not `SUCCESS_AND_FAILURE`.

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Other Logon/Logoff Events** to **Success and Failure**.

From the command line:

```powershell
auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

### [Ensure Special Logon Auditing Is Set To Include Success](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#special-logon-auditing-is-set-to-include-success)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.5

**Finding:** Special Logon auditing does not include Success.

Audits use of a special logon, which carries administrator-equivalent privileges and can elevate a process to a higher level.

This rule fails when `specialLogon` does not include `SUCCESS` (must be `SUCCESS` or `SUCCESS_AND_FAILURE`).

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Special Logon** to include **Success**.

From the command line:

```powershell
auditpol /set /subcategory:"Special Logon" /success:enable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

## 17.6 Object Access

### [Ensure Detailed File Share Auditing Is Set To Include Failure](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#detailed-file-share-auditing-is-set-to-include-failure)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.6

**Finding:** Detailed File Share auditing does not include Failure.

Audits attempts to access individual files and folders on a shared folder.

This rule fails when `detailedFileShare` does not include `FAILURE` (must be `FAILURE` or `SUCCESS_AND_FAILURE`).

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access\Audit Detailed File Share** to include **Failure**.

From the command line:

```powershell
auditpol /set /subcategory:"Detailed File Share" /failure:enable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

### [Ensure File Share Auditing Is Set To Success And Failure](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#file-share-auditing-is-set-to-success-and-failure)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.6

**Finding:** File Share auditing does not cover the required outcomes.

Audits attempts to access a shared folder.

This rule fails when `fileShare` is not `SUCCESS_AND_FAILURE`.

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access\Audit File Share** to **Success and Failure**.

From the command line:

```powershell
auditpol /set /subcategory:"File Share" /success:enable /failure:enable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

### [Ensure Other Object Access Events Auditing Is Set To Success And Failure](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#other-object-access-events-auditing-is-set-to-success-and-failure)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.6

**Finding:** Other Object Access Events auditing does not cover the required outcomes.

Audits events generated by management of Task Scheduler jobs and COM+ objects.

This rule fails when `otherObjectAccessEvents` is not `SUCCESS_AND_FAILURE`.

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access\Audit Other Object Access Events** to **Success and Failure**.

From the command line:

```powershell
auditpol /set /subcategory:"Other Object Access Events" /success:enable /failure:enable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

### [Ensure Removable Storage Auditing Is Set To Success And Failure](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#removable-storage-auditing-is-set-to-success-and-failure)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.6

**Finding:** Removable Storage auditing does not cover the required outcomes.

Audits user attempts to access file system objects on a removable storage device, for both successful and failed access requests.

This rule fails when `removableStorage` is not `SUCCESS_AND_FAILURE`.

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access\Audit Removable Storage** to **Success and Failure**.

From the command line:

```powershell
auditpol /set /subcategory:"Removable Storage" /success:enable /failure:enable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

## 17.7 Policy Change

### [Ensure Audit Policy Change Auditing Is Set To Include Success](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#audit-policy-change-auditing-is-set-to-include-success)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.7

**Finding:** Audit Policy Change auditing does not include Success.

Audits changes to the audit policy, including system audit policy changes and SACL changes on objects.

This rule fails when `auditPolicyChange` does not include `SUCCESS` (must be `SUCCESS` or `SUCCESS_AND_FAILURE`).

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Policy Change\Audit Audit Policy Change** to include **Success**.

From the command line:

```powershell
auditpol /set /subcategory:"Audit Policy Change" /success:enable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

### [Ensure Authentication Policy Change Auditing Is Set To Include Success](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#authentication-policy-change-auditing-is-set-to-include-success)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.7

**Finding:** Authentication Policy Change auditing does not include Success.

Audits changes to authentication policy, such as trust creation or removal, Kerberos policy changes, and security-access grants.

This rule fails when `authenticationPolicyChange` does not include `SUCCESS` (must be `SUCCESS` or `SUCCESS_AND_FAILURE`).

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Policy Change\Audit Authentication Policy Change** to include **Success**.

From the command line:

```powershell
auditpol /set /subcategory:"Authentication Policy Change" /success:enable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

### [Ensure Authorization Policy Change Auditing Is Set To Include Success](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#authorization-policy-change-auditing-is-set-to-include-success)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.7

**Finding:** Authorization Policy Change auditing does not include Success.

Audits changes to authorization policy, including user-right assignments and changes to object permissions and access policies.

This rule fails when `authorizationPolicyChange` does not include `SUCCESS` (must be `SUCCESS` or `SUCCESS_AND_FAILURE`).

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Policy Change\Audit Authorization Policy Change** to include **Success**.

From the command line:

```powershell
auditpol /set /subcategory:"Authorization Policy Change" /success:enable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

### [Ensure MPSSVC Rule-Level Policy Change Auditing Is Set To Success And Failure](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#mpssvc-rule-level-policy-change-auditing-is-set-to-success-and-failure)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.7

**Finding:** MPSSVC Rule-Level Policy Change auditing does not cover the required outcomes.

Audits changes to Windows Firewall (Microsoft Protection Service, MPSSVC) policy rules and the active rule set.

This rule fails when `mpssvcRuleLevelPolicyChange` is not `SUCCESS_AND_FAILURE`.

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Policy Change\Audit MPSSVC Rule-Level Policy Change** to **Success and Failure**.

From the command line:

```powershell
auditpol /set /subcategory:"MPSSVC Rule-Level Policy Change" /success:enable /failure:enable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

### [Ensure Other Policy Change Events Auditing Is Set To Include Failure](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#other-policy-change-events-auditing-is-set-to-include-failure)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.7

**Finding:** Other Policy Change Events auditing does not include Failure.

Audits other policy change events such as EFS Data Recovery Agent policy changes, Windows Filtering Platform filter changes, and Cryptographic Next Generation operations.

This rule fails when `otherPolicyChangeEvents` does not include `FAILURE` (must be `FAILURE` or `SUCCESS_AND_FAILURE`).

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Policy Change\Audit Other Policy Change Events** to include **Failure**.

From the command line:

```powershell
auditpol /set /subcategory:"Other Policy Change Events" /failure:enable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

## 17.8 Privilege Use

### [Ensure Sensitive Privilege Use Auditing Is Set To Success](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#sensitive-privilege-use-auditing-is-set-to-success)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.8

**Finding:** Sensitive Privilege Use auditing does not cover the required outcomes.

Audits when a user account or service uses a sensitive privilege, such as acting as part of the operating system, debugging programs, or loading device drivers.

This rule fails when `sensitivePrivilegeUse` is not `SUCCESS`.

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Privilege Use\Audit Sensitive Privilege Use** to **Success**.

From the command line:

```powershell
auditpol /set /subcategory:"Sensitive Privilege Use" /success:enable /failure:disable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

## 17.9 System

### [Ensure IPsec Driver Auditing Is Set To Success And Failure](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#ipsec-driver-auditing-is-set-to-success-and-failure)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.9

**Finding:** IPsec Driver auditing does not cover the required outcomes.

Audits activities of the IPsec driver, including dropped inbound packets that fail integrity or replay checks and IPsec service start and stop events.

This rule fails when `ipsecDriver` is not `SUCCESS_AND_FAILURE`.

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\System\Audit IPsec Driver** to **Success and Failure**.

From the command line:

```powershell
auditpol /set /subcategory:"IPsec Driver" /success:enable /failure:enable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

### [Ensure Other System Events Auditing Is Set To Success And Failure](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#other-system-events-auditing-is-set-to-success-and-failure)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.9

**Finding:** Other System Events auditing does not cover the required outcomes.

Audits other system events, including Windows Firewall service and driver start, stop, and failure events.

This rule fails when `otherSystemEvents` is not `SUCCESS_AND_FAILURE`.

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\System\Audit Other System Events** to **Success and Failure**.

From the command line:

```powershell
auditpol /set /subcategory:"Other System Events" /success:enable /failure:enable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

### [Ensure Security State Change Auditing Is Set To Include Success](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#security-state-change-auditing-is-set-to-include-success)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.9

**Finding:** Security State Change auditing does not include Success.

Audits changes in the security state of the system, such as security subsystem startup and shutdown and system time changes.

This rule fails when `securityStateChange` does not include `SUCCESS` (must be `SUCCESS` or `SUCCESS_AND_FAILURE`).

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\System\Audit Security State Change** to include **Success**.

From the command line:

```powershell
auditpol /set /subcategory:"Security State Change" /success:enable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

### [Ensure Security System Extension Auditing Is Set To Include Success](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#security-system-extension-auditing-is-set-to-include-success)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.9

**Finding:** Security System Extension auditing does not include Success.

Audits the loading of extension code such as authentication and notification packages by the security subsystem, and service installation.

This rule fails when `securitySystemExtension` does not include `SUCCESS` (must be `SUCCESS` or `SUCCESS_AND_FAILURE`).

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\System\Audit Security System Extension** to include **Success**.

From the command line:

```powershell
auditpol /set /subcategory:"Security System Extension" /success:enable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

### [Ensure System Integrity Auditing Is Set To Success And Failure](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html#system-integrity-auditing-is-set-to-success-and-failure)

Medium severity · Wartiva check · CIS Microsoft Windows 11 Stand-alone Benchmark 17.9

**Finding:** System Integrity auditing does not cover the required outcomes.

Audits violations of the integrity of the security subsystem, including dropped audit messages, code integrity failures, and cryptographic operation failures.

This rule fails when `systemIntegrity` is not `SUCCESS_AND_FAILURE`.

**Rationale:** Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

**Impact:** Enabling this audit subcategory generates additional entries in the Security event log.

#### Remediation

To configure via Group Policy, set **Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\System\Audit System Integrity** to **Success and Failure**.

From the command line:

```powershell
auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable
```

Framework mappings

- **CIS Controls v8**: 8.5 Collect Detailed Audit Logs
- **NIST SP 800-53 Rev. 5**: AU-3 Content of Audit Records; AU-7 Audit Record Reduction and Report Generation; AU-12 Audit Record Generation; SI-4 System Monitoring
- **PCI DSS v4.0.1**: 9.4.5 Keep a log-based inventory of electronic media holding cardholder data; 10.2.1.2 Log all actions by administrators, including interactive account use; 10.2.1.5 Record account creation, privilege elevation, and other credential changes

Risk

High Profile Threat

MITRE ATT&CK tactic

Defense Evasion ([TA0005](https://attack.mitre.org/tactics/TA0005/))

---

Wartiva is in early access. Request access: https://wartiva.com/early-access.html  
All pages: https://wartiva.com/llms.txt