(GH-1755) Add two new DSC resources to manage AuditPolicy

.github/skills/code-review/security.instructions.md

@@ -1,5 +1,5 @@
 ---
-applyTo: 'lib/dsc-lib/src/util.rs,lib/dsc-lib-security_context/**,lib/dsc-lib-registry/**,resources/registry/**,resources/windows_firewall/**,resources/windows_service/**,resources/dism_dsc/**'
+applyTo: 'lib/dsc-lib/src/util.rs,lib/dsc-lib-security_context/**,lib/dsc-lib-registry/**,resources/registry/**,resources/windows_firewall/**,resources/windows_service/**,resources/windows_audit_policy/**,resources/dism_dsc/**'
 description: 'Code review guidance for security-sensitive code (ACLs, policy, credentials, elevated resources)'
 ---
 

.github/skills/code-review/windows.instructions.md

@@ -1,5 +1,5 @@
 ---
-applyTo: 'resources/windows_firewall/**,resources/windows_service/**,resources/WindowsUpdate/**,resources/windows_personalization/**,resources/dism_dsc/**,resources/registry/**,lib/dsc-lib-registry/**,lib/dsc-lib-pal/**'
+applyTo: 'resources/windows_firewall/**,resources/windows_service/**,resources/windows_audit_policy/**,resources/WindowsUpdate/**,resources/windows_personalization/**,resources/dism_dsc/**,resources/registry/**,lib/dsc-lib-registry/**,lib/dsc-lib-pal/**'
 description: 'Code review guidance for Windows-specific code (FFI, COM, registry, DISM, services)'
 ---
 

CHANGELOG.md

@@ -77,6 +77,22 @@ changes since the last release, see the [diff on GitHub][unreleased].
 
 ### Added
 
+- Added the `Microsoft.Windows/AuditPolicy`, `Microsoft.Windows/AuditPolicyList`, and
+  `Microsoft.Windows/AuditPolicyOption` built-in resources for managing the Windows advanced audit
+  policy natively, as a replacement for the `AuditPolicyDsc` PowerShell module. `AuditPolicy`
+  manages success and failure auditing per subcategory (by English name or GUID) through the LSA
+  audit APIs, `AuditPolicyList` manages many subcategories in one instance and applies them with a
+  single API call, and `AuditPolicyOption` manages the `CrashOnAuditFail`,
+  `FullPrivilegeAuditing`, `AuditBaseObjects`, and `AuditBaseDirectories` options. All three
+  resources support `get`, `set`, `export`, and `--what-if`.
+
+  <details><summary>Related work items</summary>
+
+  - Issues: [#1755][#1755]
+  - PRs: [#1758][#1758]
+
+  </details>
+
 - Added what-if support to the MCP server tools. The `invoke_dsc_config` tool now accepts a
   `what_if` option for the `set` operation, and the `invoke_dsc_resource` tool accepts `what_if`
   for the `set` and `delete` operations. This mirrors the `--what-if` flag on the `dsc config set`,
@@ -2000,4 +2016,5 @@ Version `3.0.0` is the first generally available release of DSC.
 [#1558]: https://github.com/PowerShell/DSC/issues/1558
 [#1562]: https://github.com/PowerShell/DSC/issues/1562
 [#1729]: https://github.com/PowerShell/DSC/issues/1729
-
+[#1755]: https://github.com/PowerShell/DSC/issues/1755
+[#1758]: https://github.com/PowerShell/DSC/issues/1758

Cargo.toml

@@ -27,6 +27,7 @@ members = [
     "resources/windows_service",
     "resources/WindowsUpdate",
     "resources/environment_variable",
+    "resources/windows_audit_policy",
     "adapters/group_policy_template",
     "tools/dsctest",
     "tools/test_group_resource",
@@ -62,6 +63,7 @@ default-members = [
     "resources/windows_service",
     "resources/WindowsUpdate",
     "resources/environment_variable",
+    "resources/windows_audit_policy",
     "adapters/group_policy_template",
     "tools/dsctest",
     "tools/test_group_resource",
@@ -98,6 +100,7 @@ Windows = [
     "resources/windows_service",
     "resources/WindowsUpdate",
     "resources/environment_variable",
+    "resources/windows_audit_policy",
     "adapters/group_policy_template",
     "tools/dsctest",
     "tools/test_group_resource",
@@ -290,17 +293,19 @@ urlencoding = { version = "2.1" }
 which = { version = "8.0.6" }
 # dsc-lib
 ipnetwork = { version = "0.21" }
-# WindowsUpdate, windows_service, dsc-lib (ACL checks), dsc-lib-registry
+# WindowsUpdate, windows_service, windows_audit_policy, dsc-lib (ACL checks), dsc-lib-registry
 windows = { version = "0.62", features = [
     "Win32_Foundation",
     "Win32_NetworkManagement_WindowsFirewall",
     "Win32_Security",
+    "Win32_Security_Authentication_Identity",
     "Win32_Security_Authorization",
     "Win32_System_Com",
     "Win32_System_Memory",
     "Win32_System_Ole",
     "Win32_System_Registry",
     "Win32_System_Services",
+    "Win32_System_Threading",
     "Win32_System_Variant",
     "Win32_System_UpdateAgent",
     "Win32_Globalization"

data.build.json

@@ -117,6 +117,8 @@
       "windows_firewall.exe",
       "windows_service.exe",
       "windows_service.dsc.resource.json",
+      "windows_audit_policy.exe",
+      "windows_audit_policy.dsc.manifests.json",
       "windows_feature.dsc.resource.json",
       "wmi.dsc.resource.json",
       "wmi.resource.ps1",

docs/reference/resources/Microsoft/Windows/AuditPolicy/examples/auditpolicy.config.dsc.yaml

@@ -0,0 +1,20 @@
+# yaml-language-server: $schema=https://aka.ms/dsc/schemas/v3/bundled/config/document.vscode.json
+$schema: https://aka.ms/dsc/schemas/v3/bundled/config/document.json
+resources:
+  - name: Audit successful and failed logons
+    type: Microsoft.Windows/AuditPolicy
+    properties:
+      subcategory: Logon
+      success: true
+      failure: true
+  - name: Audit failed credential validation
+    type: Microsoft.Windows/AuditPolicy
+    properties:
+      subcategory: Credential Validation
+      failure: true
+  - name: Disable auditing of other privilege use events
+    type: Microsoft.Windows/AuditPolicy
+    properties:
+      subcategory: Other Privilege Use Events
+      success: false
+      failure: false