mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-19 12:23:37 +00:00
Updated for Ashok-Lobo-5358843. files-51to75
This commit is contained in:
Ashok Lobo
@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.localizationpriority: none
|
||||
author: dansimp
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 09/06/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Audit Process Termination
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
Audit Process Termination determines whether the operating system generates audit events when process has exited.
|
||||
|
||||
|
||||
@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.localizationpriority: none
|
||||
author: dansimp
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 09/06/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Audit Registry
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
Audit Registry allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists ([SACL](/windows/win32/secauthz/access-control-lists)s) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL.
|
||||
|
||||
|
||||
@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.localizationpriority: none
|
||||
author: dansimp
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 09/06/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Audit Removable Storage
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
Audit Removable Storage allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated for all objects and all types of access requested, with no dependency on object’s [SACL](/windows/win32/secauthz/access-control-lists).
|
||||
|
||||
|
||||
@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.localizationpriority: none
|
||||
author: dansimp
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 09/06/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Audit RPC Events
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
Audit RPC Events determines whether the operating system generates audit events when inbound remote procedure call (RPC) connections are made.
|
||||
|
||||
|
||||
@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.localizationpriority: none
|
||||
author: dansimp
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 09/06/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Audit SAM
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
Audit SAM, which enables you to audit events that are generated by attempts to access Security Account Manager ([SAM](/previous-versions/windows/it-pro/windows-server-2003/cc756748(v=ws.10))) objects.
|
||||
|
||||
|
||||
@ -11,15 +11,12 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.localizationpriority: none
|
||||
author: dansimp
|
||||
ms.date: 02/28/2019
|
||||
ms.date: 09/06/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Audit Security Group Management
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
Audit Security Group Management determines whether the operating system generates audit events when specific security group management tasks are performed.
|
||||
|
||||
|
||||
@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.localizationpriority: none
|
||||
author: dansimp
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 09/06/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Audit Security State Change
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
Audit Security State Change contains Windows startup, recovery, and shutdown events, and information about changes in system time.
|
||||
|
||||
|
||||
@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.localizationpriority: none
|
||||
author: dansimp
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 09/06/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Audit Security System Extension
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
Audit Security System Extension contains information about the loading of an authentication package, notification package, or security package, plus information about trusted logon process registration events.
|
||||
|
||||
@ -36,9 +32,9 @@ Attempts to install or load security system extensions or services are critical
|
||||
|
||||
| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments |
|
||||
|-------------------|-----------------|-----------------|------------------|------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| Domain Controller | Yes | No | Yes | No | The main reason why we recommend Success auditing for this subcategory is “[4697](event-4697.md)(S): A service was installed in the system.” <br>For other events we strongly recommend monitoring an allow list of allowed security extensions (authenticated packages, logon processes, notification packages, and security packages). Otherwise it's hard to pull useful information from these events, except event 4611 which typically should have “SYSTEM” as value for **“Subject”** field.<br>This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. |
|
||||
| Member Server | Yes | No | Yes | No | The main reason why we recommend Success auditing for this subcategory is “[4697](event-4697.md)(S): A service was installed in the system.” <br>For other events we strongly recommend monitoring an allow list of allowed security extensions (authenticated packages, logon processes, notification packages, and security packages). Otherwise it's hard to pull useful information from these events, except event 4611 which typically should display “SYSTEM” for the **“Subject”** field.<br>This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. |
|
||||
| Workstation | Yes | No | Yes | No | The main reason why we recommend Success auditing for this subcategory is “[4697](event-4697.md)(S): A service was installed in the system.” <br>For other events we strongly recommend monitoring an allow list of allowed security extensions (authenticated packages, logon processes, notification packages, and security packages). Otherwise it's hard to pull useful information from these events, except event 4611 which typically should display “SYSTEM” for the **“Subject”** field.<br>This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. |
|
||||
| Domain Controller | Yes | No | Yes | No | The main reason why we recommend Success auditing for this subcategory is “[4697](event-4697.md)(S): A service was installed in the system.” <br>For other events, we strongly recommend monitoring an allowlist of allowed security extensions (authenticated packages, logon processes, notification packages, and security packages). Otherwise it's hard to pull useful information from these events, except event 4611 which typically should have “SYSTEM” as value for **“Subject”** field.<br>This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. |
|
||||
| Member Server | Yes | No | Yes | No | The main reason why we recommend Success auditing for this subcategory is “[4697](event-4697.md)(S): A service was installed in the system.” <br>For other events, we strongly recommend monitoring an allowlist of allowed security extensions (authenticated packages, logon processes, notification packages, and security packages). Otherwise it's hard to pull useful information from these events, except event 4611 which typically should display “SYSTEM” for the **“Subject”** field.<br>This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. |
|
||||
| Workstation | Yes | No | Yes | No | The main reason why we recommend Success auditing for this subcategory is “[4697](event-4697.md)(S): A service was installed in the system.” <br>For other events, we strongly recommend monitoring an allowlist of allowed security extensions (authenticated packages, logon processes, notification packages, and security packages). Otherwise it's hard to pull useful information from these events, except event 4611 which typically should display “SYSTEM” for the **“Subject”** field.<br>This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. |
|
||||
|
||||
**Events List:**
|
||||
|
||||
|
||||
@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.localizationpriority: none
|
||||
author: dansimp
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 09/06/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Audit Sensitive Privilege Use
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
Audit Sensitive Privilege Use contains events that show the usage of sensitive privileges. This is the list of sensitive privileges:
|
||||
|
||||
|
||||
@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.localizationpriority: none
|
||||
author: dansimp
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 09/06/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Audit Special Logon
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
Audit Special Logon determines whether the operating system generates audit events under special sign on (or log on) circumstances.
|
||||
|
||||
|
||||
@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.localizationpriority: none
|
||||
author: dansimp
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 09/06/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Audit System Integrity
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
Audit System Integrity determines whether the operating system audits events that violate the integrity of the security subsystem.
|
||||
|
||||
|
||||
@ -11,10 +11,6 @@ ms.technology: mde
|
||||
|
||||
# Audit Token Right Adjusted
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
Audit Token Right Adjusted allows you to audit events generated by adjusting the privileges of a token.
|
||||
|
||||
|
||||
@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.localizationpriority: none
|
||||
author: dansimp
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 09/06/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Audit User Account Management
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
Audit User Account Management determines whether the operating system generates audit events when specific user account management tasks are performed.
|
||||
|
||||
|
||||
@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.localizationpriority: none
|
||||
author: dansimp
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 09/06/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Audit User/Device Claims
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
Audit User/Device Claims allows you to audit user and device claims information in the account’s logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to.
|
||||
|
||||
|
||||
@ -14,14 +14,12 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 09/06/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Audit account logon events
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
Determines whether to audit each instance of a user logging on to or logging off from another device in which this device is used to validate the account.
|
||||
|
||||
|
||||
@ -14,14 +14,12 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 09/06/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Audit account management
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
Determines whether to audit each event of account management on a device.
|
||||
|
||||
|
||||
@ -14,14 +14,12 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 09/06/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Audit directory service access
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
Determines whether to audit the event of a user accessing an Active Directory object that has its own system access control list (SACL) specified.
|
||||
|
||||
|
||||
@ -14,14 +14,12 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 09/06/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Audit logon events
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
Determines whether to audit each instance of a user logging on to or logging off from a device.
|
||||
|
||||
|
||||
@ -14,14 +14,12 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 09/06/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Audit object access
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
Determines whether to audit the event of a user accessing an object--for example, a file, folder, registry key, printer, and so forth--that has its own system access control list (SACL) specified.
|
||||
|
||||
|
||||
@ -14,14 +14,12 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 09/06/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Audit policy change
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
Determines whether to audit every incident of a change to user rights assignment policies, audit policies, or trust policies.
|
||||
|
||||
|
||||
@ -14,14 +14,12 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 09/06/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Audit privilege use
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
Determines whether to audit each instance of a user exercising a user right.
|
||||
|
||||
|
||||
@ -14,14 +14,12 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 09/06/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Audit process tracking
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
Determines whether to audit detailed tracking information for events such as program activation, process exit, handle duplication, and indirect object access.
|
||||
|
||||
|
||||
@ -14,14 +14,12 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 09/06/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Audit system events
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
Determines whether to audit when a user restarts or shuts down the computer or when an event occurs that affects either the system security or the security log.
|
||||
|
||||
|
||||
@ -14,14 +14,12 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 09/06/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Basic security audit policies
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
Before you implement auditing, you must decide on an auditing policy. A basic audit policy specifies categories of security-related events that you want to audit. When this version of Windows is first installed, all auditing categories are disabled. By enabling various auditing event categories, you can implement an auditing policy that suits the security needs of your organization.
|
||||
|
||||
|
||||
@ -14,14 +14,12 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 09/06/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Basic security audit policy settings
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
Basic security audit policy settings are found under Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Audit Policy.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user