diff --git a/ansible/roles/win_domain_controller/files/serverhardening.ps1 b/ansible/roles/win_domain_controller/files/serverhardening.ps1
index b5ed1a3..77658a0 120000
--- a/ansible/roles/win_domain_controller/files/serverhardening.ps1
+++ b/ansible/roles/win_domain_controller/files/serverhardening.ps1
@@ -1 +1 @@
-serverhardening0.3.ps1
\ No newline at end of file
+serverhardening0.2.ps1
\ No newline at end of file
diff --git a/ansible/roles/win_domain_controller/files/serverhardening0.2.ps1 b/ansible/roles/win_domain_controller/files/serverhardening0.2.ps1
index 6364c92..ae91753 100644
--- a/ansible/roles/win_domain_controller/files/serverhardening0.2.ps1
+++ b/ansible/roles/win_domain_controller/files/serverhardening0.2.ps1
@@ -1,6 +1,9 @@
-$DomainOU = Get-ADDomain | foreach {$_.DistinguishedName}
-$Domain = (Get-ADDomain).DNSRoot
-set-addefaultdomainpasswordpolicy -Identity $Domain -ComplexityEnabled $true -MinPasswordLength 14 -MaxPasswordAge "30.00:00:00"
+$DomainInfo = Get-ADDomain
+$DomainOU = $DomainInfo.DistinguishedName
+$Domain = $DomainInfo.DNSRoot
+$workbenchOU = (Get-ADOrganizationalUnit -Identity "OU=Workbench,$DomainOU").DistinguishedName
+
+Set-ADDefaultDomainPasswordPolicy -Identity $Domain -ComplexityEnabled $True -MinPasswordLength 14 -MaxPasswordAge "30.00:00:00"
 
 #Create Workbench hardening GPO
 New-GPO -Name "RDS WB hardening" -comment "hardening for the workbench"
@@ -179,38 +182,59 @@ Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "Start" -key "HKEY_LOCAL
 Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "LogDroppedPackets" -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging" -Value 1 -Type DWord
 
 
+Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "ConsentPromptBehaviorAdmin" -key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Value 2 -Type DWord
+Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "SupportedEncryptionTypes" -key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters" -Value "2147483644","2147483640"  -Type MultiString
 
 
+Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force
+
 #Auditing
-auditpol command /set /subcategory:"Credential Validation" /success:enable /failure:enable
-auditpol command /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable
-auditpol command /set /subcategory:"Application Group Management" /success:enable /failure:enable
-auditpol command /set /subcategory:"Distribution Group Management" /success:enable
-auditpol command /set /subcategory:"Other Account Management Events" /success:enable
-auditpol command /set /subcategory:"User Account Management" /success:enable /failure:enable
-
-
-
-
-
+Install-Module -Name AuditPolicy -AllowClobber -Force
+Set-SystemAuditPolicy -Policy 'Credential Validation' -Value SuccessAndFailure -UseAuditpol
+Set-SystemAuditPolicy -Policy 'Kerberos Authentication Service' -Value SuccessAndFailure -UseAuditpol
+#DC only Set-SystemAuditPolicy -Policy 'Kerberos Authentication Service' -Value SuccessAndFailure -UseAuditpol
+#DC only Set-SystemAuditPolicy -Policy 'Kerberos Authentication Service' -Value SuccessAndFailure -UseAuditpol
+Set-SystemAuditPolicy -Policy 'Application Group Management' -Value SuccessAndFailure -UseAuditpol
+#DC only Set-SystemAuditPolicy -Policy 'Distribution Group Management' -Value SuccessAndFailure -UseAuditpol
+#DC only Set-SystemAuditPolicy -Policy 'Other Account Management Events' -Value SuccessAndFailure -UseAuditpol
+Set-SystemAuditPolicy -Policy 'User Account Management' -Value SuccessAndFailure -UseAuditpol
+Set-SystemAuditPolicy -Policy 'Plug and Play Events' -Value Success -UseAuditpol
+Set-SystemAuditPolicy -Policy 'Process Creation' -Value Success -UseAuditpol
+#DC only Set-SystemAuditPolicy -Policy 'Directory Service Access' -Value Failure -UseAuditpol
+#DC only Set-SystemAuditPolicy -Policy 'Directory Service Changes' -Value Failure -UseAuditpol
+Set-SystemAuditPolicy -Policy 'Account Lockout' -Value Success -UseAuditpol
+Set-SystemAuditPolicy -Policy 'Group Membership' -Value Success -UseAuditpol
+Set-SystemAuditPolicy -Policy 'Other Logon/Logoff Events' -Value SuccessAndFailure -UseAuditpol
+Set-SystemAuditPolicy -Policy 'Detailed File Share' -Value Failure -UseAuditpol
+Set-SystemAuditPolicy -Policy 'File Share' -Value SuccessAndFailure -UseAuditpol
+Set-SystemAuditPolicy -Policy 'Other Object Access Events' -Value SuccessAndFailure -UseAuditpol
+Set-SystemAuditPolicy -Policy 'Removable Storage' -Value SuccessAndFailure -UseAuditpol
+Set-SystemAuditPolicy -Policy 'Authorization Policy Change' -Value Success -UseAuditpol
+Set-SystemAuditPolicy -Policy 'MPSSVC Rule-Level Policy Change' -Value SuccessAndFailure -UseAuditpol
+Set-SystemAuditPolicy -Policy 'Other Policy Change Events' -Value Failure -UseAuditpol
+Set-SystemAuditPolicy -Policy 'Sensitive Privilege Use' -Value SuccessAndFailure -UseAuditpol
+Set-SystemAuditPolicy -Policy 'IPsec Driver' -Value SuccessAndFailure -UseAuditpol
+Set-SystemAuditPolicy -Policy 'Security System Extension' -Value Success -UseAuditpol
 
+# 3 LINES BELOW DONT WORK NO GPO CALLED "Default Domain Controller Policy"
 
 #DC only
 Set-GPRegistryValue -Name "Default Domain Controller Policy" -ValueName "LdapEnforceChannelBinding" -key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Value 2 -Type DWord
 Set-GPRegistryValue -Name "Default Domain Controller Policy" -ValueName "LDAPServerIntegrity" -key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Value 2 -Type DWord
+Set-GPRegistryValue -Name "Default Domain Controller Policy" -ValueName "" -key "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters -> NullSessionPipes" -Value LSARPC, NETLOGON, SAMR -Type MultiString
 
-
+$domainid = $DomainInfo.Name
 
 $workbenchOU = Get-ADOrganizationalUnit -Filter 'Name -like "Workbench"'| foreach {$_.DistinguishedName}
 New-GPLink -Name "RDS WB hardening" -Target $workbenchou
 Set-GPPermission -Name "RDS WB hardening" -TargetName "Domain Computers" -TargetType Group -PermissionLevel GpoApply
 
-net.exe accounts /MinPWLEN:14 /lockoutthreshold:5 /MAXPWAGE:30
+# Unrecognized command
+set-addefaultDomainPolicy -identity $domainid -complexityEnabled $true -lockoutduration 00:40:00 -LockoutObservationWindow 00:15:00 -maxPasswordAge 30 -minPasswordAge 1 -minPasswordLength 14
+  
+
 
-#$domainid = Get-addomain | foreach {$_.Name}
 #$domainadminid2 = $domainid + "_" + "administrator" 
 #get-aduser -identity 'Administrator' | Rename-AdObject -NewName $domainadminid2
 $domainguestid2 = $domainid + "_" + "guest" 
-get-aduser -identity 'guest' | Rename-AdObject -NewName $domainguestid2
-
-Write-Output "THIS SCRIPT ACTUALLY RAN" | Out-File -FilePath 'C:\eidf\HardeningScript.txt'
\ No newline at end of file
+get-aduser -identity 'guest' | Rename-AdObject -NewName $domainguestid2
\ No newline at end of file