(GH-1755) Add two new DSC resources to manage AuditPolicy

.github/skills/code-review/security.instructions.md

@@ -1,5 +1,5 @@
 ---
-applyTo: 'lib/dsc-lib/src/util.rs,lib/dsc-lib-security_context/**,lib/dsc-lib-registry/**,resources/registry/**,resources/windows_firewall/**,resources/windows_service/**,resources/dism_dsc/**'
+applyTo: 'lib/dsc-lib/src/util.rs,lib/dsc-lib-security_context/**,lib/dsc-lib-registry/**,resources/registry/**,resources/windows_firewall/**,resources/windows_service/**,resources/windows_audit_policy/**,resources/dism_dsc/**'
 description: 'Code review guidance for security-sensitive code (ACLs, policy, credentials, elevated resources)'
 ---
 

.github/skills/code-review/windows.instructions.md

@@ -1,5 +1,5 @@
 ---
-applyTo: 'resources/windows_firewall/**,resources/windows_service/**,resources/WindowsUpdate/**,resources/windows_personalization/**,resources/dism_dsc/**,resources/registry/**,lib/dsc-lib-registry/**,lib/dsc-lib-pal/**'
+applyTo: 'resources/windows_firewall/**,resources/windows_service/**,resources/windows_audit_policy/**,resources/WindowsUpdate/**,resources/windows_personalization/**,resources/dism_dsc/**,resources/registry/**,lib/dsc-lib-registry/**,lib/dsc-lib-pal/**'
 description: 'Code review guidance for Windows-specific code (FFI, COM, registry, DISM, services)'
 ---
 

CHANGELOG.md

@@ -77,6 +77,19 @@ changes since the last release, see the [diff on GitHub][unreleased].
 
 ### Added
 
+- Added the `Microsoft.Windows/AuditPolicy` and `Microsoft.Windows/AuditPolicyOption` built-in
+  resources for managing the Windows advanced audit policy natively, as a replacement for the
+  `AuditPolicyDsc` PowerShell module. `AuditPolicy` manages success and failure auditing per
+  subcategory (by English name or GUID) through the LSA audit APIs, and `AuditPolicyOption`
+  manages the `CrashOnAuditFail`, `FullPrivilegeAuditing`, `AuditBaseObjects`, and
+  `AuditBaseDirectories` options. Both resources support `get`, `set`, `export`, and `--what-if`.
+
+  <details><summary>Related work items</summary>
+
+  - Issues: [#1755][#1755]
+
+  </details>
+
 - Added what-if support to the MCP server tools. The `invoke_dsc_config` tool now accepts a
   `what_if` option for the `set` operation, and the `invoke_dsc_resource` tool accepts `what_if`
   for the `set` and `delete` operations. This mirrors the `--what-if` flag on the `dsc config set`,
@@ -1999,5 +2012,5 @@ Version `3.0.0` is the first generally available release of DSC.
 [#1557]: https://github.com/PowerShell/DSC/issues/1557
 [#1558]: https://github.com/PowerShell/DSC/issues/1558
 [#1562]: https://github.com/PowerShell/DSC/issues/1562
+[#1755]: https://github.com/PowerShell/DSC/issues/1755
 [#1729]: https://github.com/PowerShell/DSC/issues/1729
-

Cargo.toml

@@ -27,6 +27,7 @@ members = [
     "resources/windows_service",
     "resources/WindowsUpdate",
     "resources/environment_variable",
+    "resources/windows_audit_policy",
     "adapters/group_policy_template",
     "tools/dsctest",
     "tools/test_group_resource",
@@ -62,6 +63,7 @@ default-members = [
     "resources/windows_service",
     "resources/WindowsUpdate",
     "resources/environment_variable",
+    "resources/windows_audit_policy",
     "adapters/group_policy_template",
     "tools/dsctest",
     "tools/test_group_resource",
@@ -98,6 +100,7 @@ Windows = [
     "resources/windows_service",
     "resources/WindowsUpdate",
     "resources/environment_variable",
+    "resources/windows_audit_policy",
     "adapters/group_policy_template",
     "tools/dsctest",
     "tools/test_group_resource",
@@ -290,17 +293,19 @@ urlencoding = { version = "2.1" }
 which = { version = "8.0.6" }
 # dsc-lib
 ipnetwork = { version = "0.21" }
-# WindowsUpdate, windows_service, dsc-lib (ACL checks), dsc-lib-registry
+# WindowsUpdate, windows_service, windows_audit_policy, dsc-lib (ACL checks), dsc-lib-registry
 windows = { version = "0.62", features = [
     "Win32_Foundation",
     "Win32_NetworkManagement_WindowsFirewall",
     "Win32_Security",
+    "Win32_Security_Authentication_Identity",
     "Win32_Security_Authorization",
     "Win32_System_Com",
     "Win32_System_Memory",
     "Win32_System_Ole",
     "Win32_System_Registry",
     "Win32_System_Services",
+    "Win32_System_Threading",
     "Win32_System_Variant",
     "Win32_System_UpdateAgent",
     "Win32_Globalization"

data.build.json

@@ -117,6 +117,8 @@
       "windows_firewall.exe",
       "windows_service.exe",
       "windows_service.dsc.resource.json",
+      "windows_audit_policy.exe",
+      "windows_audit_policy.dsc.manifests.json",
       "windows_feature.dsc.resource.json",
       "wmi.dsc.resource.json",
       "wmi.resource.ps1",

docs/reference/resources/Microsoft/Windows/AuditPolicy/examples/auditpolicy.config.dsc.yaml

@@ -0,0 +1,20 @@
+# yaml-language-server: $schema=https://aka.ms/dsc/schemas/v3/bundled/config/document.vscode.json
+$schema: https://aka.ms/dsc/schemas/v3/bundled/config/document.json
+resources:
+  - name: Audit successful and failed logons
+    type: Microsoft.Windows/AuditPolicy
+    properties:
+      subcategory: Logon
+      success: true
+      failure: true
+  - name: Audit failed credential validation
+    type: Microsoft.Windows/AuditPolicy
+    properties:
+      subcategory: Credential Validation
+      failure: true
+  - name: Disable auditing of other privilege use events
+    type: Microsoft.Windows/AuditPolicy
+    properties:
+      subcategory: Other Privilege Use Events
+      success: false
+      failure: false

docs/reference/resources/Microsoft/Windows/AuditPolicy/examples/configure-audit-policy.md

@@ -0,0 +1,256 @@
+---
+description: >
+  Example showing how to use the Microsoft.Windows/AuditPolicy resource in a DSC configuration
+  document to enforce the auditing of audit policy subcategories.
+ms.date:     10/16/2026
+ms.topic:    reference
+title:       Configure audit policy
+---
+
+# Configure audit policy
+
+This example shows how you can use the `Microsoft.Windows/AuditPolicy` resource in a DSC
+configuration document to enforce the auditing of several audit policy subcategories, as a
+hardening baseline typically requires.
+
+> [!IMPORTANT]
+> All operations of this resource require an elevated (administrator) process context. Run your
+> terminal or PowerShell session as Administrator before using `dsc config set`.
+
+## Definition
+
+The configuration document for this example defines three instances of the `AuditPolicy`
+resource.
+
+The first instance ensures that both successful and failed logon events are audited. The second
+instance ensures that failed credential validation is audited and leaves success auditing as it
+is, because the `success` property is omitted. The third instance disables auditing of the
+`Other Privilege Use Events` subcategory entirely.
+
+:::code language="yaml" source="auditpolicy.config.dsc.yaml":::
+
+Copy the configuration document and save it as `auditpolicy.config.dsc.yaml`.
+
+## Setup
+
+The output in this example assumes that the system audits successful logons only, doesn't audit
+credential validation, and audits successful privilege use events. You can set the system to this
+starting state with the following commands:
+
+```powershell
+auditpol /set /subcategory:"Logon" /success:enable /failure:disable
+auditpol /set /subcategory:"Credential Validation" /success:disable /failure:disable
+auditpol /set /subcategory:"Other Privilege Use Events" /success:enable /failure:disable
+```
+
+## Test the configuration
+
+To see whether the system is already in the desired state, use the [dsc config test][01] command.
+
+```powershell
+dsc config test --file ./auditpolicy.config.dsc.yaml
+```
+
+```yaml
+executionInformation:
+  # Elided for brevity
+metadata:
+  # Elided for brevity
+results:
+- executionInformation:
+    duration: PT0.0411372S
+  metadata:
+    Microsoft.DSC:
+      duration: PT0.0411372S
+  name: Audit successful and failed logons
+  type: Microsoft.Windows/AuditPolicy
+  result:
+    desiredState:
+      subcategory: Logon
+      success: true
+      failure: true
+    actualState:
+      subcategory: Logon
+      success: true
+      failure: false
+      guid: '{0CCE9215-69AE-11D9-BED3-505054503030}'
+      category: Logon/Logoff
+    inDesiredState: false
+    differingProperties:
+    - failure
+- executionInformation:
+    duration: PT0.0398114S
+  metadata:
+    Microsoft.DSC:
+      duration: PT0.0398114S
+  name: Audit failed credential validation
+  type: Microsoft.Windows/AuditPolicy
+  result:
+    desiredState:
+      subcategory: Credential Validation
+      failure: true
+    actualState:
+      subcategory: Credential Validation
+      success: false
+      failure: false
+      guid: '{0CCE923F-69AE-11D9-BED3-505054503030}'
+      category: Account Logon
+    inDesiredState: false
+    differingProperties:
+    - failure
+- executionInformation:
+    duration: PT0.0402517S
+  metadata:
+    Microsoft.DSC:
+      duration: PT0.0402517S
+  name: Disable auditing of other privilege use events
+  type: Microsoft.Windows/AuditPolicy
+  result:
+    desiredState:
+      subcategory: Other Privilege Use Events
+      success: false
+      failure: false
+    actualState:
+      subcategory: Other Privilege Use Events
+      success: true
+      failure: false
+      guid: '{0CCE922A-69AE-11D9-BED3-505054503030}'
+      category: Privilege Use
+    inDesiredState: false
+    differingProperties:
+    - success
+messages: []
+hadErrors: false
+```
+
+Each instance reports `inDesiredState: false` and lists only the flags that differ. The second
+instance doesn't list `success` because the configuration document doesn't specify it.
+
+## Set the configuration
+
+To enforce the desired state, use the [dsc config set][02] command.
+
+```powershell
+dsc config set --file ./auditpolicy.config.dsc.yaml
+```
+
+```yaml
+executionInformation:
+  # Elided for brevity
+metadata:
+  # Elided for brevity
+results:
+- executionInformation:
+    duration: PT0.0824631S
+  metadata:
+    Microsoft.DSC:
+      duration: PT0.0824631S
+  name: Audit successful and failed logons
+  type: Microsoft.Windows/AuditPolicy
+  result:
+    beforeState:
+      subcategory: Logon
+      success: true
+      failure: false
+      guid: '{0CCE9215-69AE-11D9-BED3-505054503030}'
+      category: Logon/Logoff
+    afterState:
+      subcategory: Logon
+      success: true
+      failure: true
+      guid: '{0CCE9215-69AE-11D9-BED3-505054503030}'
+      category: Logon/Logoff
+    changedProperties:
+    - failure
+- executionInformation:
+    duration: PT0.0811207S
+  metadata:
+    Microsoft.DSC:
+      duration: PT0.0811207S
+  name: Audit failed credential validation
+  type: Microsoft.Windows/AuditPolicy
+  result:
+    beforeState:
+      subcategory: Credential Validation
+      success: false
+      failure: false
+      guid: '{0CCE923F-69AE-11D9-BED3-505054503030}'
+      category: Account Logon
+    afterState:
+      subcategory: Credential Validation
+      success: false
+      failure: true
+      guid: '{0CCE923F-69AE-11D9-BED3-505054503030}'
+      category: Account Logon
+    changedProperties:
+    - failure
+- executionInformation:
+    duration: PT0.0807443S
+  metadata:
+    Microsoft.DSC:
+      duration: PT0.0807443S
+  name: Disable auditing of other privilege use events
+  type: Microsoft.Windows/AuditPolicy
+  result:
+    beforeState:
+      subcategory: Other Privilege Use Events
+      success: true
+      failure: false
+      guid: '{0CCE922A-69AE-11D9-BED3-505054503030}'
+      category: Privilege Use
+    afterState:
+      subcategory: Other Privilege Use Events
+      success: false
+      failure: false
+      guid: '{0CCE922A-69AE-11D9-BED3-505054503030}'
+      category: Privilege Use
+    changedProperties:
+    - success
+messages: []
+hadErrors: false
+```
+
+The second instance only changed `failure`; its `success` flag kept the current value because the
+configuration document doesn't specify it. Running `dsc config set` again makes no further
+changes because every instance is already in the desired state.
+
+## Preview the changes
+
+To see which flags would change without applying them, add the `--what-if` option to the
+`dsc config set` command. The resource reports the projected state and describes each change
+under `_metadata.whatIf`.
+
+```powershell
+dsc config set --file ./auditpolicy.config.dsc.yaml --what-if
+```
+
+```yaml
+# Elided for brevity
+results:
+- name: Audit successful and failed logons
+  type: Microsoft.Windows/AuditPolicy
+  result:
+    beforeState:
+      subcategory: Logon
+      success: true
+      failure: false
+      guid: '{0CCE9215-69AE-11D9-BED3-505054503030}'
+      category: Logon/Logoff
+    afterState:
+      subcategory: Logon
+      success: true
+      failure: true
+      guid: '{0CCE9215-69AE-11D9-BED3-505054503030}'
+      category: Logon/Logoff
+      _metadata:
+        whatIf:
+        - Would change failure auditing for subcategory 'Logon' from false to true
+    changedProperties:
+    - failure
+    - _metadata
+# Elided for brevity
+```
+
+<!-- Link definitions -->
+[01]: ../../../../../../cli/config/test.md
+[02]: ../../../../../../cli/config/set.md