(GH-1755) Add two new DSC resources to manage AuditPolicy by Gijsreyn · Pull Request #1758 · PowerShell/DSC

Gijs Reijn (Gijsreyn) · 2026-10-16T07:25:09Z

PR Summary

This change:

Adds the Microsoft.Windows/AuditPolicy resource, which manages success and failure auditing for one advanced audit policy subcategory per instance. The subcategory key accepts the English name (case-insensitive) or the GUID, and the optional success and failure booleans leave an omitted flag unchanged. get, set, export, and --what-if are supported.
Adds the Microsoft.Windows/AuditPolicyOption resource, which manages the CrashOnAuditFail, FullPrivilegeAuditing, AuditBaseObjects, and AuditBaseDirectories options as a name key with an enabled boolean, with the same operations.
Adds the windows_audit_policy crate that implements both resources from one binary and one windows_audit_policy.dsc.manifests.json file, following the environment_variable layout.
Enables the Win32_Security_Authentication_Identity and Win32_System_Threading features of the workspace windows dependency.
Adds reference docs and examples for both resources, the overview and changelog entries, the package file entries, and Pester and Rust unit tests.
Addresses the AuditPolicyDsc half of Hardening with dsc 3 ? #1755. SecurityPolicyDsc isn't covered by this change.

PR Context

#1755 asks for built-in replacements for the AuditPolicyDsc and SecurityPolicyDsc community modules so Windows hardening doesn't depend on the PowerShell adapter. AuditPolicyDsc shells out to auditpol.exe and parses its CSV output, which is localized. Its AuditPolicyGUID resource exists only to work around that, through a backup and restore of the whole policy, and its static GUID table is missing the Access Rights subcategory that current Windows builds report. Every Set in the module also swallows errors.

The new resource uses the LSA audit APIs (AuditQuerySystemPolicy, AuditSetSystemPolicy, and the enumeration and lookup functions) instead of auditpol.exe. The APIs identify subcategories by GUID and only return display names in the system language, so the crate carries a static table of the 60 known subcategories and 9 categories with their English names. Input is matched against that table or parsed as a GUID, and output always uses the English names. A GUID that isn't in the table is still accepted when the LSA knows it, and a name that isn't in the table is compared against the localized names the LSA reports, so localized input and subcategories newer than the table keep working. The resource echoes subcategory as given on get and set, so the synthetic test compares like for like, and export returns the canonical English name.

Remarks on the design

AuditPolicyDsc keys an instance on the subcategory plus a single flag and uses Ensure to turn that flag on or off. One instance per subcategory with two optional booleans covers the same cases: one flag at a time, or the full setting, without two instances for one subcategory fighting each other. When neither flag is set, the resource sends POLICY_AUDIT_EVENT_NONE rather than 0, because 0 means "unchanged" to AuditSetSystemPolicy.
Reading the audit policy needs SeSecurityPrivilege, so the manifest requires an elevated context for get and export as well as set, and the binary returns exit code 4 when invoked directly without elevation. The privilege is enabled on the process token before the API calls, because an elevated token holds it but doesn't enable it by default.
The four options are the registry values under HKLM\SYSTEM\CurrentControlSet\Control\Lsa that secedit and Group Policy write, so the option resource reads and writes them through dsc-lib-registry instead of parsing auditpol /get /option output, which is localized too. The existing value type (REG_DWORD, or the one-byte REG_BINARY of FullPrivilegeAuditing) is preserved, any non-zero value reads as enabled (including the 2 that marks a system that already halted on CrashOnAuditFail), and a set emits a warning that the change takes effect after a restart.
The AuditPolicyCsv backup and restore resource and per-user audit policy aren't ported.

Lastly, the PR used most of the instructions to create it.

Copilot

🟡 Changes recommended

Argument validation can allow unintended live policy changes, and preview error handling, registry type preservation, and test assumptions need correction.

8 open findings

What changed in this PR

Adds native Windows audit-policy resources, addressing the AuditPolicyDsc portion of #1755 without requiring the PowerShell adapter.

Changes:

Implements subcategory auditing and registry-backed audit options with get, set, export, and what-if support.
Integrates the resources into Windows builds and packaging.
Adds tests, reference documentation, and configuration examples.

File	Description
resources/windows_audit_policy/windows_audit_policy.dsc.manifests.json	Defines both resource contracts.
resources/windows_audit_policy/tests/windows_audit_policy_whatif.tests.ps1	Tests previews and non-mutation.
resources/windows_audit_policy/tests/windows_audit_policy_set.tests.ps1	Tests subcategory changes.
resources/windows_audit_policy/tests/windows_audit_policy_option.tests.ps1	Tests registry-backed options.
resources/windows_audit_policy/tests/windows_audit_policy_get.tests.ps1	Tests lookup and validation.
resources/windows_audit_policy/tests/windows_audit_policy_export.tests.ps1	Tests exported policy state.
resources/windows_audit_policy/src/types.rs	Defines state, flags, and errors.
resources/windows_audit_policy/src/subcategories.rs	Maps English names and GUIDs.
resources/windows_audit_policy/src/options.rs	Reads and writes audit options.
resources/windows_audit_policy/src/main.rs	Dispatches resource operations.
resources/windows_audit_policy/src/audit.rs	Implements native audit API operations.
resources/windows_audit_policy/locales/en-us.toml	Supplies localized messages.
resources/windows_audit_policy/Cargo.toml	Defines crate dependencies.
resources/windows_audit_policy/build.rs	Tracks translation changes.
resources/windows_audit_policy/.project.data.json	Registers the Windows build project.
docs/reference/resources/overview.md	Lists both resources.
docs/reference/resources/Microsoft/Windows/AuditPolicyOption/index.md	Documents audit options.
docs/reference/resources/Microsoft/Windows/AuditPolicyOption/examples/configure-audit-policy-option.md	Demonstrates option configuration.
docs/reference/resources/Microsoft/Windows/AuditPolicyOption/examples/auditpolicyoption.config.dsc.yaml	Provides an option configuration.
docs/reference/resources/Microsoft/Windows/AuditPolicy/index.md	Documents subcategory auditing.
docs/reference/resources/Microsoft/Windows/AuditPolicy/examples/get-audit-policy.md	Demonstrates retrieval and export.
docs/reference/resources/Microsoft/Windows/AuditPolicy/examples/configure-audit-policy.md	Demonstrates configuration and previews.
docs/reference/resources/Microsoft/Windows/AuditPolicy/examples/auditpolicy.config.dsc.yaml	Provides a subcategory configuration.
data.build.json	Adds Windows package files.
CHANGELOG.md	Announces the resources.
Cargo.toml	Registers the crate and Windows features.
Cargo.lock	Records crate dependencies.
.github/skills/code-review/windows.instructions.md	Extends Windows review scope.
.github/skills/code-review/security.instructions.md	Extends security review scope.

🧠 Review effort: Balanced

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

…into PowerShellgh-1755/main/add-auditpolicy-dsc-resource

Copilot

🔵 Needs a closer look

Privileged audit-policy changes require Windows runtime validation and human security review before approval.

1 open issue

Reject missing input values to preserve preview mode · New

8 resolved since last review

_{Review effort: Balanced}

Steve Lee (SteveL-MSFT) · 2026-10-18T20:58:06Z

Jason Helmick (@theJasonHelmick) Michael Greene (@mgreenegit) can you help review from a schema/user experience perspective?

Jason Helmick (theJasonHelmick) · 2026-10-19T14:35:58Z

Schema/UX looks good to me. One reminder before merge: please make sure the --what-if argument-parsing issue Copilot flagged is fixed, since a preview run shouldn’t be able to write. I haven’t reviewed the code.

Jason Helmick (theJasonHelmick)

LGTM!

Mikey Lombardi (He/Him) (michaeltlombardi)

Quick review of the schemas and for the most part, everything looks good to me. I do feel a little uncomfortable with subcategory accepting either <english name> or <guid> but always returning <english name> especially when we also have guid as a read-only property. It seems like users should specify either guid or subcategory but not both and always return subcategory as the name and guid as the GUID.

I don't have strong enough feelings to block the PR on this design aspect though.

Copilot

🔵 Needs a closer look

Privileged audit-policy and security-registry changes require human review and Windows integration validation before approval.

3 open issues

1 resolved since last review

Reject missing input values to preserve preview mode

_{Review effort: Balanced}

+[01]: ../../../../../../cli/resource/get.md
+[02]: ../../../../../../cli/resource/test.md
+[03]: ../../../../../../cli/resource/export.md


+/// English subcategory name from the static table, falling back to the LSA's localized name.
+fn subcategory_display_name(guid: &GUID) -> Result<String, AuditError> {
+    match subcategories::find_by_guid(guid.to_u128()) {
+        Some(entry) => Ok(entry.name.to_string()),
+        None => lookup_subcategory_name(guid),


+    let all = enumerate_subcategories(None)?;
+    for guid in all.as_slice() {
+        let name = lookup_subcategory_name(guid)?;
+        if name.eq_ignore_ascii_case(wanted) {


Copilot AI balanced review requested due to automatic review settings October 16, 2026 07:25

Copilot started reviewing on behalf of Gijs Reijn (Gijsreyn) October 16, 2026 07:25

View session

(PowerShellGH-1755) Add two new DSC resources to manage AuditPolicy

b1532c9

Gijs Reijn (Gijsreyn) force-pushed the gh-1755/main/add-auditpolicy-dsc-resource branch from b915f29 to b1532c9 Compare October 16, 2026 07:28

Copilot AI reviewed Oct 16, 2026

View reviewed changes

Gijs Reijn (Gijsreyn) added 2 commits October 17, 2026 02:05

Resolve Copilot remarks

a5e4fa9

Merge branch 'main' of https://github.com/Gijsreyn/operation-methods …

222f55e

…into PowerShellgh-1755/main/add-auditpolicy-dsc-resource

Steve Lee (SteveL-MSFT) requested a balanced review from Copilot October 18, 2026 20:48

Copilot started reviewing on behalf of Steve Lee (SteveL-MSFT) October 18, 2026 20:49

View session

Copilot AI reviewed Oct 18, 2026

View reviewed changes

Comment thread resources/windows_audit_policy/src/main.rs Outdated

Steve Lee (SteveL-MSFT) requested changes Oct 18, 2026

View reviewed changes

Comment thread docs/reference/resources/Microsoft/Windows/AuditPolicy/examples/auditpolicy.config.dsc.yaml

Steve Lee (SteveL-MSFT) requested review from Michael Greene (mgreenegit) and Jason Helmick (theJasonHelmick) October 18, 2026 20:58

Jason Helmick (theJasonHelmick) approved these changes Oct 19, 2026

View reviewed changes

Mikey Lombardi (He/Him) (michaeltlombardi) reviewed Oct 19, 2026

View reviewed changes

Comment thread resources/windows_audit_policy/windows_audit_policy.dsc.manifests.json Outdated

Comment thread resources/windows_audit_policy/windows_audit_policy.dsc.manifests.json Outdated

Added AuditPolicyList resource

f3f0ce6

Steve Lee (SteveL-MSFT) requested a balanced review from Copilot October 19, 2026 21:19

Copilot started reviewing on behalf of Steve Lee (SteveL-MSFT) October 19, 2026 21:19

View session

Copilot AI reviewed Oct 19, 2026

View reviewed changes

Navigation Menu

Repository navigation

(GH-1755) Add two new DSC resources to manage AuditPolicy - #1758

(GH-1755) Add two new DSC resources to manage AuditPolicy#1758
Gijs Reijn (Gijsreyn) wants to merge 4 commits into
PowerShell:mainfrom
Gijsreyn:gh-1755/main/add-auditpolicy-dsc-resource

Gijs Reijn (Gijsreyn) commented Oct 16, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Steve Lee (SteveL-MSFT) commented Oct 18, 2026

Uh oh!

Jason Helmick (theJasonHelmick) commented Oct 19, 2026

Uh oh!

Jason Helmick (theJasonHelmick) left a comment

Uh oh!

Mikey Lombardi (He/Him) (michaeltlombardi) left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

Gijs Reijn (Gijsreyn) commented Oct 16, 2026

PR Summary

PR Context

Remarks on the design

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Uh oh!

Uh oh!

Steve Lee (SteveL-MSFT) commented Oct 18, 2026

Uh oh!

Jason Helmick (theJasonHelmick) commented Oct 19, 2026

Uh oh!

Jason Helmick (theJasonHelmick) left a comment

Choose a reason for hiding this comment

Uh oh!

Mikey Lombardi (He/Him) (michaeltlombardi) left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants