[
    {
        "GPO":  "MSFT Windows 11 25H2 - Computer",
        "Subcategory":  "Audit Credential Validation",
        "SubcategoryGUID":  "{0cce923f-69ae-11d9-bed3-505054503030}",
        "InclusionSetting":  "Success and Failure",
        "SettingValue":  "3"
    },
    {
        "GPO":  "MSFT Windows 11 25H2 - Computer",
        "Subcategory":  "Audit Security Group Management",
        "SubcategoryGUID":  "{0cce9237-69ae-11d9-bed3-505054503030}",
        "InclusionSetting":  "Success",
        "SettingValue":  "1"
    },
    {
        "GPO":  "MSFT Windows 11 25H2 - Computer",
        "Subcategory":  "Audit User Account Management",
        "SubcategoryGUID":  "{0cce9235-69ae-11d9-bed3-505054503030}",
        "InclusionSetting":  "Success and Failure",
        "SettingValue":  "3"
    },
    {
        "GPO":  "MSFT Windows 11 25H2 - Computer",
        "Subcategory":  "Audit PNP Activity",
        "SubcategoryGUID":  "{0cce9248-69ae-11d9-bed3-505054503030}",
        "InclusionSetting":  "Success",
        "SettingValue":  "1"
    },
    {
        "GPO":  "MSFT Windows 11 25H2 - Computer",
        "Subcategory":  "Audit Process Creation",
        "SubcategoryGUID":  "{0cce922b-69ae-11d9-bed3-505054503030}",
        "InclusionSetting":  "Success",
        "SettingValue":  "1"
    },
    {
        "GPO":  "MSFT Windows 11 25H2 - Computer",
        "Subcategory":  "Audit Account Lockout",
        "SubcategoryGUID":  "{0cce9217-69ae-11d9-bed3-505054503030}",
        "InclusionSetting":  "Failure",
        "SettingValue":  "2"
    },
    {
        "GPO":  "MSFT Windows 11 25H2 - Computer",
        "Subcategory":  "Audit Group Membership",
        "SubcategoryGUID":  "{0cce9249-69ae-11d9-bed3-505054503030}",
        "InclusionSetting":  "Success",
        "SettingValue":  "1"
    },
    {
        "GPO":  "MSFT Windows 11 25H2 - Computer",
        "Subcategory":  "Audit Logon",
        "SubcategoryGUID":  "{0cce9215-69ae-11d9-bed3-505054503030}",
        "InclusionSetting":  "Success and Failure",
        "SettingValue":  "3"
    },
    {
        "GPO":  "MSFT Windows 11 25H2 - Computer",
        "Subcategory":  "Audit Other Logon/Logoff Events",
        "SubcategoryGUID":  "{0cce921c-69ae-11d9-bed3-505054503030}",
        "InclusionSetting":  "Success and Failure",
        "SettingValue":  "3"
    },
    {
        "GPO":  "MSFT Windows 11 25H2 - Computer",
        "Subcategory":  "Audit Special Logon",
        "SubcategoryGUID":  "{0cce921b-69ae-11d9-bed3-505054503030}",
        "InclusionSetting":  "Success",
        "SettingValue":  "1"
    },
    {
        "GPO":  "MSFT Windows 11 25H2 - Computer",
        "Subcategory":  "Audit Detailed File Share",
        "SubcategoryGUID":  "{0cce9244-69ae-11d9-bed3-505054503030}",
        "InclusionSetting":  "Failure",
        "SettingValue":  "2"
    },
    {
        "GPO":  "MSFT Windows 11 25H2 - Computer",
        "Subcategory":  "Audit File Share",
        "SubcategoryGUID":  "{0cce9224-69ae-11d9-bed3-505054503030}",
        "InclusionSetting":  "Success and Failure",
        "SettingValue":  "3"
    },
    {
        "GPO":  "MSFT Windows 11 25H2 - Computer",
        "Subcategory":  "Audit Other Object Access Events",
        "SubcategoryGUID":  "{0cce9227-69ae-11d9-bed3-505054503030}",
        "InclusionSetting":  "Success and Failure",
        "SettingValue":  "3"
    },
    {
        "GPO":  "MSFT Windows 11 25H2 - Computer",
        "Subcategory":  "Audit Removable Storage",
        "SubcategoryGUID":  "{0cce9245-69ae-11d9-bed3-505054503030}",
        "InclusionSetting":  "Success and Failure",
        "SettingValue":  "3"
    },
    {
        "GPO":  "MSFT Windows 11 25H2 - Computer",
        "Subcategory":  "Audit Audit Policy Change",
        "SubcategoryGUID":  "{0cce922f-69ae-11d9-bed3-505054503030}",
        "InclusionSetting":  "Success",
        "SettingValue":  "1"
    },
    {
        "GPO":  "MSFT Windows 11 25H2 - Computer",
        "Subcategory":  "Audit Authentication Policy Change",
        "SubcategoryGUID":  "{0cce9230-69ae-11d9-bed3-505054503030}",
        "InclusionSetting":  "Success",
        "SettingValue":  "1"
    },
    {
        "GPO":  "MSFT Windows 11 25H2 - Computer",
        "Subcategory":  "Audit MPSSVC Rule-Level Policy Change",
        "SubcategoryGUID":  "{0cce9232-69ae-11d9-bed3-505054503030}",
        "InclusionSetting":  "Success and Failure",
        "SettingValue":  "3"
    },
    {
        "GPO":  "MSFT Windows 11 25H2 - Computer",
        "Subcategory":  "Audit Other Policy Change Events",
        "SubcategoryGUID":  "{0cce9234-69ae-11d9-bed3-505054503030}",
        "InclusionSetting":  "Failure",
        "SettingValue":  "2"
    },
    {
        "GPO":  "MSFT Windows 11 25H2 - Computer",
        "Subcategory":  "Audit Sensitive Privilege Use",
        "SubcategoryGUID":  "{0cce9228-69ae-11d9-bed3-505054503030}",
        "InclusionSetting":  "Success",
        "SettingValue":  "1"
    },
    {
        "GPO":  "MSFT Windows 11 25H2 - Computer",
        "Subcategory":  "Audit Other System Events",
        "SubcategoryGUID":  "{0cce9214-69ae-11d9-bed3-505054503030}",
        "InclusionSetting":  "Success and Failure",
        "SettingValue":  "3"
    },
    {
        "GPO":  "MSFT Windows 11 25H2 - Computer",
        "Subcategory":  "Audit Security State Change",
        "SubcategoryGUID":  "{0cce9210-69ae-11d9-bed3-505054503030}",
        "InclusionSetting":  "Success",
        "SettingValue":  "1"
    },
    {
        "GPO":  "MSFT Windows 11 25H2 - Computer",
        "Subcategory":  "Audit Security System Extension",
        "SubcategoryGUID":  "{0cce9211-69ae-11d9-bed3-505054503030}",
        "InclusionSetting":  "Success",
        "SettingValue":  "1"
    },
    {
        "GPO":  "MSFT Windows 11 25H2 - Computer",
        "Subcategory":  "Audit System Integrity",
        "SubcategoryGUID":  "{0cce9212-69ae-11d9-bed3-505054503030}",
        "InclusionSetting":  "Success and Failure",
        "SettingValue":  "3"
    }
]