6.3 KiB
title, description, ms.assetid, ms.pagetype, ms.prod, ms.mktglfcycl, ms.sitesec, author
| title | description | ms.assetid | ms.pagetype | ms.prod | ms.mktglfcycl | ms.sitesec | author |
|---|---|---|---|---|---|---|---|
| Audit Registry (Windows 10) | This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Registry, which determines whether the operating system generates audit events when users attempt to access registry objects. | 02bcc23b-4823-46ac-b822-67beedf56b32 | security | w10 | deploy | library | Mir0sh |
Audit Registry
Applies to
- Windows 10
- Windows Server 2016
Audit Registry allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL.
If success auditing is enabled, an audit entry is generated each time any account successfully accesses a registry object that has a matching SACL. If failure auditing is enabled, an audit entry is generated each time any user unsuccessfully attempts to access a registry object that has a matching SACL.
Event volume: Low to Medium, depending on how registry SACLs are configured.
| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments |
|---|---|---|---|---|---|
| Domain Controller | IF | IF | IF | IF | We strongly recommend that you develop a Registry Objects Security Monitoring policy and define appropriate SACLs for registry objects for different operating system templates and roles. Do not enable this subcategory if you have not planned how to use and analyze the collected information. It is also important to delete non-effective, excess SACLs. Otherwise the auditing log will be overloaded with useless information. Failure events can show you unsuccessful attempts to access specific registry objects. Consider enabling this subcategory for critical computers first, after you develop a Registry Objects Security Monitoring policy for them. |
| Member Server | IF | IF | IF | IF | |
| Workstation | IF | IF | IF | IF |
Events List:
-
4663(S): An attempt was made to access an object.
-
4656(S, F): A handle to an object was requested.
-
4658(S): The handle to an object was closed.
-
4660(S): An object was deleted.
-
4657(S): A registry value was modified.
-
5039(-): A registry key was virtualized.
-
4670(S): Permissions on an object were changed.