Add "Advanced Audit Policy" Rule Handling

[FrederickGeek8]

Pull Request (PR) description:

This PR adds proper handling for "Advanced Audit Policy" rules that were not being applied (as was reported in #1533). These rules appear in Windows 10, 11, and Server STIGs are currently are no-ops. In essence, this PR is just changing the parsing logic of AuditPolicyRule to support the new language used by those items. Rather than overloading the parsing of AuditPolicyRuleConvert, I created & modified a copy of that file, introducing AuditPolicyRuleAdvancedConvert.

This Pull Request (PR) fixes the following issues:

This PR fixes #1533 (and other related STIGs like Win11 and WinServer). In doing so, 8-9 STIG items are now applied across Windows Client/Server STIGs.

# of rules now covered:

WindowsClient-10-3.5.xml: 9 Rules Added
WindowsClient-10-3.6.xml: 9 Rules Added
WindowsClient-11-2.6.xml: 9 Rules Added
WindowsClient-11-2.7.xml: 9 Rules Added
WindowsServer-2019-DC-3.7.xml: 8 Rules Added
WindowsServer-2019-DC-3.8.xml: 8 Rules Added
WindowsServer-2019-MS-3.7.xml: 8 Rules Added
WindowsServer-2019-MS-3.8.xml: 8 Rules Added
WindowsServer-2022-DC-2.7.xml: 8 Rules Added
WindowsServer-2022-DC-2.8.xml: 8 Rules Added
WindowsServer-2022-MS-2.7.xml: 8 Rules Added
WindowsServer-2022-MS-2.8.xml: 8 Rules Added
WindowsServer-2025-DC-1.1.xml: 8 Rules Added
WindowsServer-2025-MS-1.1.xml: 8 Rules Added

Task list:

• Change details added to Unreleased section of CHANGELOG.md (Not required for Convert modules)?
• Added/updated documentation, comment-based help and descriptions where appropriate?
• Examples appropriately updated?
• New/changed code adheres to Style Guidelines?
• Unit and (optional) Integration tests created/updated where possible?

[FrederickGeek8]

@microsoft-github-policy-service agree company="Full Spectrum Software LLC"

[FrederickGeek8]

@MrAutomater can you (or someone else) take a look at this and tell me if it's a reasonable approach for addressing #1533?

If I get a thumbs up for this general approach then I can work on adding tests, rebasing, and updating generated files.

Thanks!

[MrAutomater]

I am on vacation this week, but I can take a look when I get back next week and let you know Thanks, Jerry Martin

…

________________________________ From: Frederick Morlock ***@***.***> Sent: Monday, 22 June 2026 12:30:36 To: microsoft/PowerStig ***@***.***> Cc: Jerry Martin ***@***.***>; Mention ***@***.***> Subject: Re: [microsoft/PowerStig] Add "Advanced Audit Policy" Rule Handling (PR #1556) [https://avatars.githubusercontent.com/u/774597?s=20&v=4]FrederickGeek8 left a comment (microsoft/PowerStig#1556)<#1556 (comment)> @MrAutomater<https://github.com/MrAutomater> can you (or someone else) take a look at this and tell me if it's a reasonable approach for addressing #1533<#1533>? If I get a thumbs up for this general approach then I can work on adding tests, rebasing, and updating generated files. Thanks! — Reply to this email directly, view it on GitHub<#1556?email_source=notifications&email_token=AICAG35DVAHXEAP7T3BJIN35BFULZA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTINZXGEYDKNJQGIYKM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-4771055020>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AICAG34FYYO3JNUNZVWIMDL5BFULZAVCNFSNUABFKJSXA33TNF2G64TZHMYTGMRRGAYDKMRZHNEXG43VMU5TINRYGUYTQMJVGM42C5QC>. Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS<https://github.com/notifications/mobile/ios/AICAG3ZJZMAH5Q5G3Z4GQWD5BFULZA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTINZXGEYDKNJQGIYKM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJKTGN5XXIZLSL5UW64Y> and Android<https://github.com/notifications/mobile/android/AICAG343N7Y33E2QVWPHQP35BFULZA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTINZXGEYDKNJQGIYKM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLTGN5XXIZLSL5QW4ZDSN5UWI>. Download it today! You are receiving this because you were mentioned.Message ID: ***@***.***>

[FrederickGeek8]

I just rebased my branch, added tests, and updated processed files.

Unfortunately copying AuditPolicyRule was not as clean as I had hoped -- I wanted AuditPolicyRuleAdvancedConvert to inherit from AuditPolicyRule, but that breaks one test that checks the name of the Base class. To solve that failing test, I created a AuditPolicyRuleAdvanced class that inherits from AuditPolicyRule. Because of that, there is a <AuditPolicyRuleAdvanced> section that is generated in the XML. It works, but not as minimal a change as I had wanted.

Not sure if that changes whether you/we want to merge AuditPolicyRule and AuditPolicyRuleAdvanced's logic into one rule.

[FrederickGeek8]

I had to make some small tweaks to my implementation get the tests to pass (it turns out I was running them incorrectly locally). I also updated the "Unreleased" section of the Changelog. I did not bump the version number -- not sure if that's something you'd do.

This should be ready for review now!

[FrederickGeek8]

@MrAutomater I've rebased on dev, written (passing) tests, and updated the generated XML files. Any chance you or someone else has the bandwidth to review this PR? Thanks! Sorry to ping.