deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-25 23:33:35 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

fixing spacing issues

Browse Source
This commit is contained in:
Brian Lich
2016-05-19 14:52:11 -07:00
parent bfa34cacc3
commit eb9290389d
85 changed files with 2243 additions and 3427 deletions
Download Patch File Download Diff File Expand all files Collapse all files

56
windows/keep-secure/audit-authorization-policy-change.md
View File

@ -2,63 +2,39 @@
title: Audit Authorization Policy Change (Windows 10)
description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Authorization Policy Change, which determines whether the operating system generates audit events when specific changes are made to the authorization policy.
ms.assetid: ca0587a2-a2b3-4300-aa5d-48b4553c3b36
ms.pagetype: security
ms.prod: W10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
---
# Audit Authorization Policy Change
**Applies to**
- Windows 10
This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Authorization Policy Change**, which determines whether the operating system generates audit events when specific changes are made to the authorization policy.
Authorization policy changes that can be audited include:
- Assigning or removing user rights (privileges) such as **SeCreateTokenPrivilege**, except for the system access rights that are audited by using the [Audit Authentication Policy Change](audit-authentication-policy-change.md) subcategory.
- Changing the Encrypting File System (EFS) policy.
<<<<<<< HEAD
Event volume: Low
=======
Event volume: Very high
>>>>>>> master
Default: Not configured
<table>
<colgroup>
<col width="50%" />
<col width="50%" />
</colgroup>
<thead>
<tr class="header">
<th align="left">Event ID</th>
<th align="left">Event message</th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td align="left"><p>4704</p></td>
<td align="left"><p>A user right was assigned.</p></td>
</tr>
<tr class="even">
<td align="left"><p>4705</p></td>
<td align="left"><p>A user right was removed.</p></td>
</tr>
<tr class="odd">
<td align="left"><p>4706</p></td>
<td align="left"><p>A new trust was created to a domain.</p></td>
</tr>
<tr class="even">
<td align="left"><p>4707</p></td>
<td align="left"><p>A trust to a domain was removed.</p></td>
</tr>
<tr class="odd">
<td align="left"><p>4714</p></td>
<td align="left"><p>Encrypted data recovery policy was changed.</p></td>
</tr>
</tbody>
</table>
| Event ID | Event message |
| - | - |
| 4704 | A user right was assigned. |
| 4705 | A user right was removed. |
| 4706 | A new trust was created to a domain. |
| 4707 | A trust to a domain was removed. |
| 4714 | Encrypted data recovery policy was changed. |
 
## Related topics
[Advanced security audit policy settings](advanced-security-audit-policy-settings.md)
- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)