How does the 'Check Microsoft firewall status' audit work?