(GH-1755) Add two new DSC resources to manage AuditPolicy

[Gijs Reijn (Gijsreyn)]

PR Summary

This change:

• Adds the Microsoft.Windows/AuditPolicy resource, which manages success and failure auditing for one advanced audit policy subcategory per instance. The subcategory key accepts the English name (case-insensitive) or the GUID, and the optional success and failure booleans leave an omitted flag unchanged. get, set, export, and --what-if are supported.
• Adds the Microsoft.Windows/AuditPolicyOption resource, which manages the CrashOnAuditFail, FullPrivilegeAuditing, AuditBaseObjects, and AuditBaseDirectories options as a name key with an enabled boolean, with the same operations.
• Adds the windows_audit_policy crate that implements both resources from one binary and one windows_audit_policy.dsc.manifests.json file, following the environment_variable layout.
• Enables the Win32_Security_Authentication_Identity and Win32_System_Threading features of the workspace windows dependency.
• Adds reference docs and examples for both resources, the overview and changelog entries, the package file entries, and Pester and Rust unit tests.
• Addresses the AuditPolicyDsc half of Hardening with dsc 3 ? #1755. SecurityPolicyDsc isn't covered by this change.

PR Context

#1755 asks for built-in replacements for the AuditPolicyDsc and SecurityPolicyDsc community modules so Windows hardening doesn't depend on the PowerShell adapter. AuditPolicyDsc shells out to auditpol.exe and parses its CSV output, which is localized. Its AuditPolicyGUID resource exists only to work around that, through a backup and restore of the whole policy, and its static GUID table is missing the Access Rights subcategory that current Windows builds report. Every Set in the module also swallows errors.

The new resource uses the LSA audit APIs (AuditQuerySystemPolicy, AuditSetSystemPolicy, and the enumeration and lookup functions) instead of auditpol.exe. The APIs identify subcategories by GUID and only return display names in the system language, so the crate carries a static table of the 60 known subcategories and 9 categories with their English names. Input is matched against that table or parsed as a GUID, and output always uses the English names. A GUID that isn't in the table is still accepted when the LSA knows it, and a name that isn't in the table is compared against the localized names the LSA reports, so localized input and subcategories newer than the table keep working. The resource echoes subcategory as given on get and set, so the synthetic test compares like for like, and export returns the canonical English name.

Remarks on the design

• AuditPolicyDsc keys an instance on the subcategory plus a single flag and uses Ensure to turn that flag on or off. One instance per subcategory with two optional booleans covers the same cases: one flag at a time, or the full setting, without two instances for one subcategory fighting each other. When neither flag is set, the resource sends POLICY_AUDIT_EVENT_NONE rather than 0, because 0 means "unchanged" to AuditSetSystemPolicy.
• Reading the audit policy needs SeSecurityPrivilege, so the manifest requires an elevated context for get and export as well as set, and the binary returns exit code 4 when invoked directly without elevation. The privilege is enabled on the process token before the API calls, because an elevated token holds it but doesn't enable it by default.
• The four options are the registry values under HKLM\SYSTEM\CurrentControlSet\Control\Lsa that secedit and Group Policy write, so the option resource reads and writes them through dsc-lib-registry instead of parsing auditpol /get /option output, which is localized too. The existing value type (REG_DWORD, or the one-byte REG_BINARY of FullPrivilegeAuditing) is preserved, any non-zero value reads as enabled (including the 2 that marks a system that already halted on CrashOnAuditFail), and a set emits a warning that the change takes effect after a restart.
• The AuditPolicyCsv backup and restore resource and per-user audit policy aren't ported.

Lastly, the PR used most of the instructions to create it.

[Copilot]

🟡 Changes recommended

Argument validation can allow unintended live policy changes, and preview error handling, registry type preservation, and test assumptions need correction.

8 open findings

• Reject unknown arguments before dispatching set operations · New
• Propagate policy query errors in what-if mode · New
• Preserve REG_QWORD type when updating audit policy options · New
• Use UI culture for auditpol language detection · New
• Establish disabled state before idempotency assertion · New
• Preserve existing type when testing FullPrivilegeAuditing · New
• Use UI culture when asserting localized auditpol output · New
• Make tests independent of preceding test state · New

What changed in this PR

Adds native Windows audit-policy resources, addressing the AuditPolicyDsc portion of #1755 without requiring the PowerShell adapter.

Changes:

• Implements subcategory auditing and registry-backed audit options with get, set, export, and what-if support.
• Integrates the resources into Windows builds and packaging.
• Adds tests, reference documentation, and configuration examples.

File	Description
resources/​windows_audit_policy/​windows_audit_policy.dsc.manifests.json	Defines both resource contracts.
resources/​windows_audit_policy/​tests/​windows_audit_policy_whatif.tests.ps1	Tests previews and non-mutation.
resources/​windows_audit_policy/​tests/​windows_audit_policy_set.tests.ps1	Tests subcategory changes.
resources/​windows_audit_policy/​tests/​windows_audit_policy_option.tests.ps1	Tests registry-backed options.
resources/​windows_audit_policy/​tests/​windows_audit_policy_get.tests.ps1	Tests lookup and validation.
resources/​windows_audit_policy/​tests/​windows_audit_policy_export.tests.ps1	Tests exported policy state.
resources/​windows_audit_policy/​src/​types.rs	Defines state, flags, and errors.
resources/​windows_audit_policy/​src/​subcategories.rs	Maps English names and GUIDs.
resources/​windows_audit_policy/​src/​options.rs	Reads and writes audit options.
resources/​windows_audit_policy/​src/​main.rs	Dispatches resource operations.
resources/​windows_audit_policy/​src/​audit.rs	Implements native audit API operations.
resources/​windows_audit_policy/​locales/​en-us.toml	Supplies localized messages.
resources/​windows_audit_policy/​Cargo.toml	Defines crate dependencies.
resources/​windows_audit_policy/​build.rs	Tracks translation changes.
resources/​windows_audit_policy/​.project.data.json	Registers the Windows build project.
docs/​reference/​resources/​overview.md	Lists both resources.
docs/​reference/​resources/​Microsoft/​Windows/​AuditPolicyOption/​index.md	Documents audit options.
docs/​reference/​resources/​Microsoft/​Windows/​AuditPolicyOption/​examples/​configure-audit-policy-option.md	Demonstrates option configuration.
docs/​reference/​resources/​Microsoft/​Windows/​AuditPolicyOption/​examples/​auditpolicyoption.config.dsc.yaml	Provides an option configuration.
docs/​reference/​resources/​Microsoft/​Windows/​AuditPolicy/​index.md	Documents subcategory auditing.
docs/​reference/​resources/​Microsoft/​Windows/​AuditPolicy/​examples/​get-audit-policy.md	Demonstrates retrieval and export.
docs/​reference/​resources/​Microsoft/​Windows/​AuditPolicy/​examples/​configure-audit-policy.md	Demonstrates configuration and previews.
docs/​reference/​resources/​Microsoft/​Windows/​AuditPolicy/​examples/​auditpolicy.config.dsc.yaml	Provides a subcategory configuration.
data.build.json	Adds Windows package files.
CHANGELOG.md	Announces the resources.
Cargo.toml	Registers the crate and Windows features.
Cargo.lock	Records crate dependencies.
.github/​skills/​code-review/​windows.instructions.md	Extends Windows review scope.
.github/​skills/​code-review/​security.instructions.md	Extends security review scope.

🧠 Review effort: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.