diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index 7f3ffd9290..5d5b50ce4d 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 09/19/2019 +ms.date: 09/24/2019 --- # Policy CSP - Audit @@ -218,10 +218,10 @@ ms.date: 09/19/2019 cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -238,7 +238,7 @@ ms.date: 09/19/2019 -This policy setting allows you to audit events generated by a failed attempt to log on to an account that is locked out. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by a failed attempt to log on to an account that is locked out. If you configure this policy setting, an audit event is generated when an account cannot log on to a computer because the account is locked out. Success audits record successful attempts and Failure audits record unsuccessful attempts. @@ -256,11 +256,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default) — Success - 2 — Failure - 3 — Success+Failure -Default: Success. @@ -288,10 +287,10 @@ Default: Success. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -308,7 +307,7 @@ Default: Success. -This policy allows you to audit the group memberhsip information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. +Available in Windows 10, version 1803 and later. This policy allows you to audit the group memberhsip information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group memberhsip information cannot fit in a single security audit event. @@ -322,12 +321,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -355,10 +353,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -375,7 +373,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation. @@ -391,12 +389,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -424,10 +421,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -444,7 +441,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation. @@ -459,12 +456,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -492,10 +488,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -512,7 +508,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.If you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. @@ -527,12 +523,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -560,10 +555,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -580,7 +575,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. If you do not configure this policy setting, no audit event is generated when a logon session is closed. @@ -596,11 +591,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default) — Success - 2 — Failure - 3 — Success+Failure -Default: Success. @@ -628,10 +622,10 @@ Default: Success. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -648,7 +642,7 @@ Default: Success. -This policy setting allows you to audit events generated by user account logon attempts on the computer. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by user account logon attempts on the computer. Events in this subcategory are related to the creation of logon sessions and occur on the computer which was accessed. For an interactive logon, the security audit event is generated on the computer that the user account logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. The following events are included: - Successful logon attempts. @@ -667,13 +661,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default on Client editions) — Success - 2 — Failure -- 3 — Success+Failure +- 3 (default on Server editions) — Success+Failure -Default on Client editions: Success. - -Default on Server editions: Success, Failure. @@ -701,10 +692,10 @@ Default on Server editions: Success, Failure. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -721,7 +712,7 @@ Default on Server editions: Success, Failure. -This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. If you do not configure this policy settings, IAS and NAP user access requests are not audited. @@ -768,10 +759,10 @@ Default: Success, Failure. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -788,7 +779,7 @@ Default: Success, Failure. -This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting, such as the following: - Terminal Services session disconnections. - New Terminal Services sessions. - Locking and unlocking a workstation. @@ -808,12 +799,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -841,10 +831,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -861,7 +851,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by special logons, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by special logons, such as the following: - The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. - A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [article 947223 in the Microsoft Knowledge Base](https://go.microsoft.com/fwlink/?LinkId=121697). @@ -876,11 +866,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default) — Success - 2 — Failure - 3 — Success+Failure -Default: Success. @@ -908,10 +897,10 @@ Default: Success. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -928,7 +917,7 @@ Default: Success. -This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. +Available in Windows 10, version 1803 and later. This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. User claims are added to a logon token when claims are included with a user's account attributes in Active Directory. Device claims are added to the logon token when claims are included with a device's computer account attributes in Active Directory. In addition, compound identity must be enabled for the domain and on the computer where the user logged on. @@ -944,12 +933,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -977,10 +965,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -997,7 +985,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by validation tests on user account logon credentials. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by validation tests on user account logon credentials. Events in this subcategory occur only on the computer that is authoritative for those credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. @@ -1011,14 +999,11 @@ GP Info: The following are the supported values: -- 0 — Off/None -- 1 — Success +- 0 (default on Client editions) — Off/None +- 1 (default on Server editions) — Success - 2 — Failure - 3 — Success+Failure -Default on Client editions: No Auditing. - -Default on Server editions: Success. @@ -1046,10 +1031,10 @@ Default on Server editions: Success. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1066,7 +1051,7 @@ Default on Server editions: Success. -This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT request. @@ -1081,14 +1066,11 @@ GP Info: The following are the supported values: -- 0 — Off/None -- 1 — Success +- 0 (default on Client editions) — Off/None +- 1 (default on Server editions) — Success - 2 — Failure - 3 — Success+Failure -Default on Client editions: No Auditing - -Default on Server editions: Success. @@ -1116,10 +1098,10 @@ Default on Server editions: Success. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1136,7 +1118,7 @@ Default on Server editions: Success. -This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account. @@ -1151,14 +1133,11 @@ GP Info: The following are the supported values: -- 0 — Off/None -- 1 — Success +- 0 (default on Client editions) — Off/None +- 1 (default on Server editions) — Success - 2 — Failure - 3 — Success+Failure -Default on Client editions: No Auditing. - -Default on Server editions: Success. @@ -1186,10 +1165,10 @@ Default on Server editions: Success. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1206,7 +1185,7 @@ Default on Server editions: Success. -This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. Currently, there are no events in this subcategory. @@ -1219,12 +1198,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -1252,10 +1230,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1272,7 +1250,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by changes to application groups, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to application groups, such as the following: - Application group is created, changed, or deleted. - Member is added or removed from an application group. @@ -1289,12 +1267,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -1322,10 +1299,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1342,7 +1319,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a computer account changes. @@ -1357,14 +1334,11 @@ GP Info: The following are the supported values: -- 0 — Off/None -- 1 — Success +- 0 (default on Client editions) — Off/None +- 1 (default on Server editions) — Success - 2 — Failure - 3 — Success+Failure -Default on Client editions: No Auditing. - -Default on Server editions: Success. @@ -1392,10 +1366,10 @@ Default on Server editions: Success. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1412,7 +1386,7 @@ Default on Server editions: Success. -This policy setting allows you to audit events generated by changes to distribution groups, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to distribution groups, such as the following: - Distribution group is created, changed, or deleted. - Member is added or removed from a distribution group. - Distribution group type is changed. @@ -1433,12 +1407,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -1466,10 +1439,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1486,7 +1459,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: - The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. - The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. - Changes to the Default Domain Group Policy under the following Group Policy paths: @@ -1506,12 +1479,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -1539,10 +1511,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1559,7 +1531,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by changes to security groups, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to security groups, such as the following: - Security group is created, changed, or deleted. - Member is added or removed from a security group. - Group type is changed. @@ -1578,11 +1550,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default) — Success - 2 — Failure - 3 — Success+Failure -Default: Success. @@ -1610,10 +1581,10 @@ Default: Success. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1630,7 +1601,7 @@ Default: Success. -This policy setting allows you to audit changes to user accounts. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit changes to user accounts. Events include the following: - A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. - A user account’s password is set or changed. @@ -1653,11 +1624,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default) — Success - 2 — Failure - 3 — Success+Failure -Default: Success. @@ -1685,10 +1655,10 @@ Default: Success. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1705,7 +1675,7 @@ Default: Success. -This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. Volume: High. @@ -1718,12 +1688,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -1751,10 +1720,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1771,7 +1740,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. Only AD DS objects with a matching system access control list (SACL) are logged. @@ -1787,14 +1756,11 @@ GP Info: The following are the supported values: -- 0 — Off/None -- 1 — Success +- 0 (default on Client editions) — Off/None +- 1 (default on Server editions) — Success - 2 — Failure - 3 — Success+Failure -Default on Client editions: No Auditing. - -Default on Server editions: Success. @@ -1822,10 +1788,10 @@ Default on Server editions: Success. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1842,7 +1808,7 @@ Default on Server editions: Success. -This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. When possible, events logged in this subcategory indicate the old and new values of the object’s properties. @@ -1864,12 +1830,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing @@ -1897,10 +1862,10 @@ Default: No Auditing cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1917,7 +1882,7 @@ Default: No Auditing -This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. If you do not configure this policy setting, no audit event is generated during AD DS replication. @@ -1935,12 +1900,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -1968,10 +1932,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1988,7 +1952,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see https://go.microsoft.com/fwlink/?LinkId=121720. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see https://go.microsoft.com/fwlink/?LinkId=121720. If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI. @@ -2003,7 +1967,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2034,10 +1998,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2054,7 +2018,7 @@ The following are the supported values: -This policy setting allows you to audit when plug and play detects an external device. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit when plug and play detects an external device. If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. @@ -2069,7 +2033,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2100,10 +2064,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2120,7 +2084,7 @@ The following are the supported values: -This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a process is created. @@ -2135,7 +2099,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2166,10 +2130,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2186,7 +2150,7 @@ The following are the supported values: -This policy setting allows you to audit events generated when a process ends. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when a process ends. If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a process ends. @@ -2232,10 +2196,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2252,7 +2216,7 @@ The following are the supported values: -This policy setting allows you to audit inbound remote procedure call (RPC) connections. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit inbound remote procedure call (RPC) connections. If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted. @@ -2267,7 +2231,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2298,10 +2262,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2318,7 +2282,7 @@ The following are the supported values: -This policy setting allows you to audit events generated by adjusting the privileges of a token. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by adjusting the privileges of a token. Volume: High. @@ -2330,12 +2294,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -2363,10 +2326,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2383,7 +2346,7 @@ Default: No Auditing. -This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. Events in this subcategory include: - Creation of an application client context. - Deletion of an application client context. @@ -2400,7 +2363,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2431,10 +2394,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2451,7 +2414,7 @@ The following are the supported values: -This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. If you configure this policy setting, an audit event is generated each time a user accesses an object and the permission granted by the current central access policy on the object differs from that granted by the proposed policy. The resulting audit event will be generated as follows: 1. Success audits, when configured, records access attempts when the current central access policy grants access but the proposed policy denies access. @@ -2470,12 +2433,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -2503,10 +2465,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2523,8 +2485,9 @@ Default: No Auditing. -This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. AD CS operations include the following: + - AD CS startup/shutdown/backup/restore. - Changes to the certificate revocation list (CRL). - New certificate requests. @@ -2552,7 +2515,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2583,10 +2546,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2603,7 +2566,7 @@ The following are the supported values: -This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. @@ -2620,7 +2583,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2651,10 +2614,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2671,7 +2634,7 @@ The following are the supported values: -This policy setting allows you to audit attempts to access a shared folder. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit attempts to access a shared folder. If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures. @@ -2688,7 +2651,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2719,10 +2682,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2739,7 +2702,7 @@ The following are the supported values: -This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see https://go.microsoft.com/fwlink/?LinkId=122083. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see [Apply a basic audit policy on a file or folder](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder). If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. @@ -2757,7 +2720,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2788,10 +2751,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2808,7 +2771,7 @@ The following are the supported values: -This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). +Available in Windows 10, version 1803 and later. This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). The following events are included: - The Windows Firewall Service blocks an application from accepting incoming connections on the network. - The WFP allows a connection. @@ -2834,7 +2797,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2865,10 +2828,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2885,7 +2848,7 @@ The following are the supported values: -This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). +Available in Windows 10, version 1803 and later. This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). Volume: High. @@ -2898,7 +2861,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2929,10 +2892,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2949,7 +2912,7 @@ The following are the supported values: -This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a handle is manipulated. @@ -2967,7 +2930,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2998,10 +2961,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3018,7 +2981,7 @@ The following are the supported values: -This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. Only kernel objects with a matching system access control list (SACL) generate security audit events. > [!Note] @@ -3034,7 +2997,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -3065,10 +3028,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3085,7 +3048,7 @@ The following are the supported values: -This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. For scheduler jobs, the following are audited: - Job created. - Job deleted. @@ -3108,7 +3071,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -3139,10 +3102,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3159,7 +3122,7 @@ The following are the supported values: -This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL. @@ -3177,7 +3140,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -3208,10 +3171,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3228,7 +3191,7 @@ The following are the supported values: -This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. @@ -3243,7 +3206,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -3274,10 +3237,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3294,7 +3257,7 @@ The following are the supported values: -This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. SAM objects include the following: - SAM_ALIAS -- A local group. - SAM_GROUP -- A group that is not a local group. @@ -3319,7 +3282,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -3350,10 +3313,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3370,7 +3333,7 @@ The following are the supported values: -This policy setting allows you to audit events generated by changes to the authentication policy, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to the authentication policy, such as the following: - Creation of forest and domain trusts. - Modification of forest and domain trusts. - Removal of forest and domain trusts. @@ -3400,11 +3363,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default) — Success - 2 — Failure - 3 — Success+Failure -Default: Success. @@ -3432,10 +3394,10 @@ Default: Success. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3452,7 +3414,7 @@ Default: Success. -This policy setting allows you to audit events generated by changes to the authorization policy, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to the authorization policy, such as the following: - Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. - Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. - Changes in the Encrypted File System (EFS) policy. @@ -3472,12 +3434,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -3505,10 +3466,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3525,7 +3486,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP), such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP), such as the following: - IPsec services status. - Changes to IPsec policy settings. - Changes to Windows Firewall policy settings. @@ -3544,12 +3505,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -3577,10 +3537,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3597,7 +3557,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. Events include the following: - Reporting of active policies when Windows Firewall service starts. - Changes to Windows Firewall rules. @@ -3619,12 +3579,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -3652,10 +3611,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3672,7 +3631,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: - Trusted Platform Module (TPM) configuration changes. - Kernel-mode cryptographic self tests. - Cryptographic provider operations. @@ -3690,12 +3649,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -3723,10 +3681,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3743,7 +3701,7 @@ Default: No Auditing. -This policy setting allows you to audit changes in the security audit policy settings, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit changes in the security audit policy settings, such as the following: - Settings permissions and audit settings on the Audit Policy object. - Changes to the system audit policy. - Registration of security event sources. @@ -3767,11 +3725,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default) — Success - 2 — Failure - 3 — Success+Failure -Default: Success. @@ -3799,10 +3756,10 @@ Default: Success. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3819,7 +3776,7 @@ Default: Success. -This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). The following privileges are non-sensitive: - Access Credential Manager as a trusted caller. - Access this computer from the network. @@ -3865,7 +3822,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -3896,10 +3853,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3927,7 +3884,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -3958,10 +3915,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3978,7 +3935,7 @@ The following are the supported values: -This policy setting allows you to audit events generated when sensitive privileges (user rights) are used, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when sensitive privileges (user rights) are used, such as the following: - A privileged service is called. - One of the following privileges are called: - Act as part of the operating system. @@ -4008,7 +3965,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -4039,10 +3996,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -4059,7 +4016,7 @@ The following are the supported values: -This policy setting allows you to audit events generated by the IPsec filter driver, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by the IPsec filter driver, such as the following: - Startup and shutdown of the IPsec services. - Network packets dropped due to integrity check failure. - Network packets dropped due to replay check failure. @@ -4080,12 +4037,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -4113,10 +4069,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -4133,7 +4089,7 @@ Default: No Auditing. -This policy setting allows you to audit any of the following events: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit any of the following events: - Startup and shutdown of the Windows Firewall service and driver. - Security policy processing by the Windows Firewall Service. - Cryptography key file and migration operations. @@ -4181,10 +4137,10 @@ Default: Success, Failure. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -4201,7 +4157,7 @@ Default: Success, Failure. -This policy setting allows you to audit events generated by changes in the security state of the computer, such as the following events: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes in the security state of the computer, such as the following events: - Startup and shutdown of the computer. - Change of system time. - Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured. @@ -4217,11 +4173,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default) — Success - 2 — Failure - 3 — Success+Failure -Default: Success. @@ -4249,10 +4204,10 @@ Default: Success. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -4269,7 +4224,7 @@ Default: Success. -This policy setting allows you to audit events related to security system extensions or services, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events related to security system extensions or services, such as the following: - A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. - A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. @@ -4286,12 +4241,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -4319,10 +4273,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -4339,7 +4293,7 @@ Default: No Auditing. -This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: - Events that could not be written to the event log because of a problem with the auditing system. - A process that uses a local procedure call (LPC) port that is not valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. - The detection of a Remote Procedure Call (RPC) that compromises system integrity.