jborean93
commented
2 years ago I'm not sure hardcoding in a list of categories and sub categories is the best idea here. IMO this module should accept 3 forms for the category and subcategory options:
- Raw GUID, allows someone to bypass all localization and specify the GUID as is
- The localized name, allows someone to enter a more user friendly and location specific setting
- If the above 2 fail then have the fallback mapping from the English name to the known GUID
I'm not 100% convinced of the 3rd one but I'm not against it. I can see how it could be convenient to have an Ansible play with the English label that works across any system but I do think we should still accept the localized variant and only have the English value as a final fallback.
As for the localization issue with auditpol it seems the better method would be to map all human readable labels of the category and subcategory to the GUID and call the auditpol commands with the GUID specified rather than the label. This keeps the commands relative simple as we don't need to quote the value and it avoids any localization problems.
To get a list of all categories and subcategories, including their localized names you can use the following code that utilities PInvoke to call the relevant Win32 function.
Click to expand!
```powershell Add-Type -TypeDefinition @' using System; using System.ComponentModel; using System.Runtime.InteropServices; namespace Community.Windows.WinAuditPolicySystem { public class Native { [DllImport("Advapi32.dll")] private static extern void AuditFree(IntPtr Buffer); [DllImport("Advapi32.dll", EntryPoint = "AuditEnumerateCategories", SetLastError = true)] [return: MarshalAs(UnmanagedType.I1)] private static extern bool NativeAuditEnumerateCategories( out IntPtr ppAuditCategoriesArray, out int pdwCountReturned); public static Guid[] AuditEnumerateCategories() { IntPtr catArray = IntPtr.Zero; int catCount = 0; if (!NativeAuditEnumerateCategories(out catArray, out catCount)) { throw new Win32Exception(); } try { IntPtr guidPtr = catArray; Guid[] categories = new Guid[catCount]; for (int i = 0; i < catCount; i++) { categories[i] = (Guid)Marshal.PtrToStructure(guidPtr, typeof(Guid)); guidPtr = IntPtr.Add(guidPtr, Marshal.SizeOf(typeof(Guid))); } return categories; } finally { AuditFree(catArray); } } [DllImport("Advapi32.dll", EntryPoint = "AuditEnumerateSubCategories", SetLastError = true)] [return: MarshalAs(UnmanagedType.I1)] private static extern bool NativeAuditEnumerateSubCategories( ref Guid pAuditCategoryGuid, [MarshalAs(UnmanagedType.I1)] bool bRetrieveAllSubCategories, out IntPtr ppAuditCategoriesArray, out int pdwCountReturned); public static Guid[] AuditEnumerateSubCategories(Guid auditCategory) { IntPtr catArray = IntPtr.Zero; int catCount = 0; if (!NativeAuditEnumerateSubCategories(ref auditCategory, false, out catArray, out catCount)) { throw new Win32Exception(); } try { IntPtr guidPtr = catArray; Guid[] categories = new Guid[catCount]; for (int i = 0; i < catCount; i++) { categories[i] = (Guid)Marshal.PtrToStructure(guidPtr, typeof(Guid)); guidPtr = IntPtr.Add(guidPtr, Marshal.SizeOf(typeof(Guid))); } return categories; } finally { AuditFree(catArray); } } [DllImport("Advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)] [return: MarshalAs(UnmanagedType.I1)] private static extern bool AuditLookupCategoryNameW( ref Guid pAuditCategoryGuid, out IntPtr ppszCategoryName); public static string AuditLookupCategoryName(Guid category) { IntPtr namePtr = IntPtr.Zero; if (!AuditLookupCategoryNameW(ref category, out namePtr)) { throw new Win32Exception(); } try { return Marshal.PtrToStringUni(namePtr); } finally { AuditFree(namePtr); } } [DllImport("Advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)] [return: MarshalAs(UnmanagedType.I1)] private static extern bool AuditLookupSubCategoryNameW( ref Guid pAuditCategoryGuid, out IntPtr ppszCategoryName); public static string AuditLookupSubCategoryName(Guid category) { IntPtr namePtr = IntPtr.Zero; if (!AuditLookupSubCategoryNameW(ref category, out namePtr)) { throw new Win32Exception(); } try { return Marshal.PtrToStringUni(namePtr); } finally { AuditFree(namePtr); } } } } '@ [Community.Windows.WinAuditPolicySystem.Native]::AuditEnumerateCategories() | ForEach-Object { $category = $_ $name = [Community.Windows.WinAuditPolicySystem.Native]::AuditLookupCategoryName($category) $subCategories = [Community.Windows.WinAuditPolicySystem.Native]::AuditEnumerateSubCategories($_) | ForEach-Object { $subName = [Community.Windows.WinAuditPolicySystem.Native]::AuditLookupSubCategoryName($_) [PSCustomObject]@{ Name = $subName Id = $_ } } [PSCustomObject]@{ Name = $name Id = $category SubCategories = $subCategories } } ```We can also still continue to use auditpol /list ... /v to get the info from the executable and still continue to work with the localized names as they can be mapped to the known GUIDs and vice versa.
clcaldwell
briantist
github-actions[bot]
guyomog78
Dylan-Bs
SUMMARY
Added a static GUID - English Name mapping for the outputs from auditpol.exe, to get around an issue caused by auditpol's outputs are localized.
Fixes #14
ISSUE TYPE
COMPONENT NAME
win_audit_policy_system
ADDITIONAL INFORMATION
This is the same method used to fix the same localization problem is the AuditPolicyDSC DSC resource: https://github.com/dsccommunity/AuditPolicyDsc/blob/03bd14a560be01a50222f1dfad739c914043b124/DSCResources/AuditPolicyResourceHelper/AuditPolicyResourceHelper.psm1#L249