From 7a8ce70e166c29520038ceea9efe68eac77f225e Mon Sep 17 00:00:00 2001
From: fukusuket <41001169+fukusuket@users.noreply.github.com>
Date: Sun, 16 Nov 2025 19:05:38 +0900
Subject: [PATCH] fix: update default auditing values in WELA.ps1

---
 WELA.ps1 | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/WELA.ps1 b/WELA.ps1
index 3daa2971..0826840c 100644
--- a/WELA.ps1
+++ b/WELA.ps1
@@ -578,7 +578,7 @@ function GuideYamatoSecurity
             "Other Account Management Events",
             $auditpol[$guid],
             [array]$rules,
-            "Success",
+            "No Auditing",
             "Success and Failure",
             "Low",
             ""
@@ -614,7 +614,7 @@ function GuideYamatoSecurity
             "User Account Management",
             $auditpol[$guid],
             [array]$rules,
-            "No Auditing",
+            "Success",
             "Success and Failure",
             "Low",
             ""
@@ -1815,7 +1815,7 @@ function GuideASD {
             "Other Account Management Events",
             $auditpol[$guid],
             [array]$rules,
-            "Success",
+            "No Auditing",
             "Success and Failure",
             "",
             ""
@@ -1851,7 +1851,7 @@ function GuideASD {
             "User Account Management",
             $auditpol[$guid],
             [array]$rules,
-            "No Auditing",
+            "Success",
             "Success and Failure",
             "",
             ""
@@ -3052,7 +3052,7 @@ function GuideMSC {
             "Other Account Management Events",
             $auditpol[$guid],
             [array]$rules,
-            "Success",
+            "No Auditing",
             "Success",
             "",
             ""
@@ -3088,7 +3088,7 @@ function GuideMSC {
             "User Account Management",
             $auditpol[$guid],
             [array]$rules,
-            "No Auditing",
+            "Success",
             "Success",
             "",
             ""
@@ -4289,7 +4289,7 @@ function GuideMSS {
             "Other Account Management Events",
             $auditpol[$guid],
             [array]$rules,
-            "Success",
+            "No Auditing",
             "Success and Failure",
             "",
             ""
@@ -4325,7 +4325,7 @@ function GuideMSS {
             "User Account Management",
             $auditpol[$guid],
             [array]$rules,
-            "No Auditing",
+            "Success",
             "Success and Failure",
             "",
             ""