deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-19 20:33:42 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Updated for 5358843-files-26to50

Browse Source
This commit is contained in:
Ashok Lobo
2021-09-06 17:10:01 +05:30
parent 607c914c8d
commit 51c4c48cee
25 changed files with 26 additions and 118 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md
View File

@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.localizationpriority: none ms.localizationpriority: none
author: dansimp author: dansimp
ms.date: 04/19/2017 ms.date: 09/06/2021
ms.technology: mde ms.technology: mde
--- ---
# Audit Filtering Platform Packet Drop # Audit Filtering Platform Packet Drop
**Applies to**
- Windows 10
- Windows Server 2016
Audit Filtering Platform Packet Drop determines whether the operating system generates audit events when packets are dropped by the [Windows Filtering Platform](/windows/win32/fwp/windows-filtering-platform-start-page). Audit Filtering Platform Packet Drop determines whether the operating system generates audit events when packets are dropped by the [Windows Filtering Platform](/windows/win32/fwp/windows-filtering-platform-start-page).

5
windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md
View File

@ -11,15 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.localizationpriority: none ms.localizationpriority: none
author: dansimp author: dansimp
ms.date: 04/19/2017 ms.date: 09/06/2021
ms.technology: mde ms.technology: mde
--- ---
# Audit Filtering Platform Policy Change # Audit Filtering Platform Policy Change
**Applies to**
- Windows 10
- Windows Server 2016
Audit Filtering Platform Policy Change allows you to audit events generated by changes to the [Windows Filtering Platform](/windows/win32/fwp/windows-filtering-platform-start-page) (WFP), such as the following: Audit Filtering Platform Policy Change allows you to audit events generated by changes to the [Windows Filtering Platform](/windows/win32/fwp/windows-filtering-platform-start-page) (WFP), such as the following:

5
windows/security/threat-protection/auditing/audit-group-membership.md
View File

@ -11,15 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.localizationpriority: none ms.localizationpriority: none
author: dansimp author: dansimp
ms.date: 04/19/2017 ms.date: 09/06/2021
ms.technology: mde ms.technology: mde
--- ---
# Audit Group Membership # Audit Group Membership
**Applies to**
- Windows 10
- Windows Server 2016
By using Audit Group Membership, you can audit group memberships when they're enumerated on the client computer. By using Audit Group Membership, you can audit group memberships when they're enumerated on the client computer.

5
windows/security/threat-protection/auditing/audit-handle-manipulation.md
View File

@ -11,15 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.localizationpriority: none ms.localizationpriority: none
author: dansimp author: dansimp
ms.date: 04/19/2017 ms.date: 09/06/2021
ms.technology: mde ms.technology: mde
--- ---
# Audit Handle Manipulation # Audit Handle Manipulation
**Applies to**
- Windows 10
- Windows Server 2016
Audit Handle Manipulation enables generation of “4658: The handle to an object was closed” in [Audit File System](audit-file-system.md), [Audit Kernel Object](audit-kernel-object.md), [Audit Registry](audit-registry.md), [Audit Removable Storage](audit-removable-storage.md) and [Audit SAM](audit-sam.md) subcategories, and shows object’s handle duplication and close actions. Audit Handle Manipulation enables generation of “4658: The handle to an object was closed” in [Audit File System](audit-file-system.md), [Audit Kernel Object](audit-kernel-object.md), [Audit Registry](audit-registry.md), [Audit Removable Storage](audit-removable-storage.md) and [Audit SAM](audit-sam.md) subcategories, and shows object’s handle duplication and close actions.

5
windows/security/threat-protection/auditing/audit-ipsec-driver.md
View File

@ -11,15 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.localizationpriority: none ms.localizationpriority: none
author: dansimp author: dansimp
ms.date: 10/02/2018 ms.date: 09/06/2021
ms.technology: mde ms.technology: mde
--- ---
# Audit IPsec Driver # Audit IPsec Driver
**Applies to**
- Windows 10
- Windows Server 2016
Audit IPsec Driver allows you to audit events generated by IPSec driver such as the following: Audit IPsec Driver allows you to audit events generated by IPSec driver such as the following:

6
windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md
View File

@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.localizationpriority: none ms.localizationpriority: none
author: dansimp author: dansimp
ms.date: 10/02/2018 ms.date: 09/06/2021
ms.technology: mde ms.technology: mde
--- ---
# Audit IPsec Extended Mode # Audit IPsec Extended Mode
**Applies to**
- Windows 10
- Windows Server 2016
Audit IPsec Extended Mode allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. Audit IPsec Extended Mode allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations.

5
windows/security/threat-protection/auditing/audit-ipsec-main-mode.md
View File

@ -11,15 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.localizationpriority: none ms.localizationpriority: none
author: dansimp author: dansimp
ms.date: 10/02/2018 ms.date: 09/06/2021
ms.technology: mde ms.technology: mde
--- ---
# Audit IPsec Main Mode # Audit IPsec Main Mode
**Applies to**
- Windows 10
- Windows Server 2016
Audit IPsec Main Mode allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. Audit IPsec Main Mode allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations.

5
windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md
View File

@ -11,15 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.localizationpriority: none ms.localizationpriority: none
author: dansimp author: dansimp
ms.date: 10/02/2018 ms.date: 09/06/2021
ms.technology: mde ms.technology: mde
--- ---
# Audit IPsec Quick Mode # Audit IPsec Quick Mode
**Applies to**
- Windows 10
- Windows Server 2016
Audit IPsec Quick Mode allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. Audit IPsec Quick Mode allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations.

6
windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md
View File

@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.localizationpriority: none ms.localizationpriority: none
author: dansimp author: dansimp
ms.date: 04/19/2017 ms.date: 09/06/2021
ms.technology: mde ms.technology: mde
--- ---
# Audit Kerberos Authentication Service # Audit Kerberos Authentication Service
**Applies to**
- Windows 10
- Windows Server 2016
Audit Kerberos Authentication Service determines whether to generate audit events for Kerberos authentication ticket-granting ticket (TGT) requests. Audit Kerberos Authentication Service determines whether to generate audit events for Kerberos authentication ticket-granting ticket (TGT) requests.

6
windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md
View File

@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.localizationpriority: none ms.localizationpriority: none
author: dansimp author: dansimp
ms.date: 04/19/2017 ms.date: 09/06/2021
ms.technology: mde ms.technology: mde
--- ---
# Audit Kerberos Service Ticket Operations # Audit Kerberos Service Ticket Operations
**Applies to**
- Windows 10
- Windows Server 2016
Audit Kerberos Service Ticket Operations determines whether the operating system generates security audit events for Kerberos service ticket requests. Audit Kerberos Service Ticket Operations determines whether the operating system generates security audit events for Kerberos service ticket requests.

6
windows/security/threat-protection/auditing/audit-kernel-object.md
View File

@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.localizationpriority: none ms.localizationpriority: none
author: dansimp author: dansimp
ms.date: 04/19/2017 ms.date: 09/06/2021
ms.technology: mde ms.technology: mde
--- ---
# Audit Kernel Object # Audit Kernel Object
**Applies to**
- Windows 10
- Windows Server 2016
Audit Kernel Object determines whether the operating system generates audit events when users attempt to access the system kernel, which includes mutexes and semaphores. Audit Kernel Object determines whether the operating system generates audit events when users attempt to access the system kernel, which includes mutexes and semaphores.

6
windows/security/threat-protection/auditing/audit-logoff.md
View File

@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.localizationpriority: none ms.localizationpriority: none
author: dansimp author: dansimp
ms.date: 07/16/2018 ms.date: 09/06/2021
ms.technology: mde ms.technology: mde
--- ---
# Audit Logoff # Audit Logoff
**Applies to**
- Windows 10
- Windows Server 2016
Audit Logoff determines whether the operating system generates audit events when logon sessions are terminated. Audit Logoff determines whether the operating system generates audit events when logon sessions are terminated.

6
windows/security/threat-protection/auditing/audit-logon.md
View File

@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.localizationpriority: none ms.localizationpriority: none
author: dansimp author: dansimp
ms.date: 04/19/2017 ms.date: 09/06/2021
ms.technology: mde ms.technology: mde
--- ---
# Audit Logon # Audit Logon
**Applies to**
- Windows 10
- Windows Server 2016
Audit Logon determines whether the operating system generates audit events when a user attempts to log on to a computer. Audit Logon determines whether the operating system generates audit events when a user attempts to log on to a computer.

6
windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md
View File

@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.localizationpriority: none ms.localizationpriority: none
author: dansimp author: dansimp
ms.date: 04/19/2017 ms.date: 09/06/2021
ms.technology: mde ms.technology: mde
--- ---
# Audit MPSSVC Rule-Level Policy Change # Audit MPSSVC Rule-Level Policy Change
**Applies to**
- Windows 10
- Windows Server 2016
Audit MPSSVC Rule-Level Policy Change determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe). Audit MPSSVC Rule-Level Policy Change determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe).

5
windows/security/threat-protection/auditing/audit-network-policy-server.md
View File

@ -11,15 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.localizationpriority: none ms.localizationpriority: none
author: dansimp author: dansimp
ms.date: 04/19/2017 ms.date: 09/06/2021
ms.technology: mde ms.technology: mde
--- ---
# Audit Network Policy Server # Audit Network Policy Server
**Applies to**
- Windows 10
- Windows Server 2016
Audit Network Policy Server allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) activity related to user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. Audit Network Policy Server allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) activity related to user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock.

6
windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md
View File

@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.localizationpriority: none ms.localizationpriority: none
author: dansimp author: dansimp
ms.date: 04/19/2017 ms.date: 09/06/2021
ms.technology: mde ms.technology: mde
--- ---
# Audit Non-Sensitive Privilege Use # Audit Non-Sensitive Privilege Use
**Applies to**
- Windows 10
- Windows Server 2016
Audit Non-Sensitive Privilege Use contains events that show usage of non-sensitive privileges. This is the list of non-sensitive privileges: Audit Non-Sensitive Privilege Use contains events that show usage of non-sensitive privileges. This is the list of non-sensitive privileges:

6
windows/security/threat-protection/auditing/audit-other-account-logon-events.md
View File

@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.localizationpriority: none ms.localizationpriority: none
author: dansimp author: dansimp
ms.date: 04/19/2017 ms.date: 09/06/2021
ms.technology: mde ms.technology: mde
--- ---
# Audit Other Account Logon Events # Audit Other Account Logon Events
**Applies to**
- Windows 10
- Windows Server 2016
**General Subcategory Information:** **General Subcategory Information:**

6
windows/security/threat-protection/auditing/audit-other-account-management-events.md
View File

@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.localizationpriority: none ms.localizationpriority: none
author: dansimp author: dansimp
ms.date: 04/19/2017 ms.date: 09/06/2021
ms.technology: mde ms.technology: mde
--- ---
# Audit Other Account Management Events # Audit Other Account Management Events
**Applies to**
- Windows 10
- Windows Server 2016
Audit Other Account Management Events determines whether the operating system generates user account management audit events. Audit Other Account Management Events determines whether the operating system generates user account management audit events.

6
windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md
View File

@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.localizationpriority: none ms.localizationpriority: none
author: dansimp author: dansimp
ms.date: 04/19/2017 ms.date: 09/06/2021
ms.technology: mde ms.technology: mde
--- ---
# Audit Other Logon/Logoff Events # Audit Other Logon/Logoff Events
**Applies to**
- Windows 10
- Windows Server 2016
Audit Other Logon/Logoff Events determines whether Windows generates audit events for other logon or logoff events. Audit Other Logon/Logoff Events determines whether Windows generates audit events for other logon or logoff events.

6
windows/security/threat-protection/auditing/audit-other-object-access-events.md
View File

@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.localizationpriority: none ms.localizationpriority: none
author: dansimp author: dansimp
ms.date: 05/29/2017 ms.date: 09/06/2021
ms.technology: mde ms.technology: mde
--- ---
# Audit Other Object Access Events # Audit Other Object Access Events
**Applies to**
- Windows 10
- Windows Server 2016
Audit Other Object Access Events allows you to monitor operations with scheduled tasks, COM+ objects and indirect object access requests. Audit Other Object Access Events allows you to monitor operations with scheduled tasks, COM+ objects and indirect object access requests.

6
windows/security/threat-protection/auditing/audit-other-policy-change-events.md
View File

@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.localizationpriority: none ms.localizationpriority: none
author: dansimp author: dansimp
ms.date: 04/19/2017 ms.date: 09/06/2021
ms.technology: mde ms.technology: mde
--- ---
# Audit Other Policy Change Events # Audit Other Policy Change Events
**Applies to**
- Windows 10
- Windows Server 2016
Audit Other Policy Change Events contains events about EFS Data Recovery Agent policy changes, changes in Windows Filtering Platform filter, status on Security policy settings updates for local Group Policy settings, Central Access Policy changes, and detailed troubleshooting events for Cryptographic Next Generation (CNG) operations. Audit Other Policy Change Events contains events about EFS Data Recovery Agent policy changes, changes in Windows Filtering Platform filter, status on Security policy settings updates for local Group Policy settings, Central Access Policy changes, and detailed troubleshooting events for Cryptographic Next Generation (CNG) operations.

5
windows/security/threat-protection/auditing/audit-other-privilege-use-events.md
View File

@ -11,15 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.localizationpriority: none ms.localizationpriority: none
author: dansimp author: dansimp
ms.date: 04/19/2017 ms.date: 09/06/2021
ms.technology: mde ms.technology: mde
--- ---
# Audit Other Privilege Use Events # Audit Other Privilege Use Events
**Applies to**
- Windows 10
- Windows Server 2016
This auditing subcategory should not have any events in it, but for some reason Success auditing will enable the generation of event [4985(S): The state of a transaction has changed](/windows/security/threat-protection/auditing/event-4985). This auditing subcategory should not have any events in it, but for some reason Success auditing will enable the generation of event [4985(S): The state of a transaction has changed](/windows/security/threat-protection/auditing/event-4985).

6
windows/security/threat-protection/auditing/audit-other-system-events.md
View File

@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.localizationpriority: none ms.localizationpriority: none
author: dansimp author: dansimp
ms.date: 04/19/2017 ms.date: 09/06/2021
ms.technology: mde ms.technology: mde
--- ---
# Audit Other System Events # Audit Other System Events
**Applies to**
- Windows 10
- Windows Server 2016
Audit Other System Events contains Windows Firewall Service and Windows Firewall driver start and stop events, failure events for these services and Windows Firewall Service policy processing failures. Audit Other System Events contains Windows Firewall Service and Windows Firewall driver start and stop events, failure events for these services and Windows Firewall Service policy processing failures.

6
windows/security/threat-protection/auditing/audit-pnp-activity.md
View File

@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.localizationpriority: none ms.localizationpriority: none
author: dansimp author: dansimp
ms.date: 04/19/2017 ms.date: 09/06/2021
ms.technology: mde ms.technology: mde
--- ---
# Audit PNP Activity # Audit PNP Activity
**Applies to**
- Windows 10
- Windows Server 2016
Audit PNP Activity determines when Plug and Play detects an external device. Audit PNP Activity determines when Plug and Play detects an external device.

6
windows/security/threat-protection/auditing/audit-process-creation.md
View File

@ -11,16 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.localizationpriority: none ms.localizationpriority: none
author: dansimp author: dansimp
ms.date: 04/19/2017 ms.date: 09/06/2021
ms.technology: mde ms.technology: mde
--- ---
# Audit Process Creation # Audit Process Creation
**Applies to**
- Windows 10
- Windows Server 2016
Audit Process Creation determines whether the operating system generates audit events when a process is created (starts). Audit Process Creation determines whether the operating system generates audit events when a process is created (starts).