© Copyright Netsurion. All Rights Reserved. 1

How-To Guide

Configure Advanced Audit Policy

for Windows

This document describes audit settings available in Windows Server 2008 onwards and Windows 7

onwards and audit events that they generate.

The security audit policy settings under Security Settings\Advanced Audit Policy Configuration can help

organizations audit compliance with important business-related and security-related rules by tracking

precise defined activities, such as:

• A group administrator has modified settings or data on servers that contain financial information.

The configuration details in this guide are consistent with Netsurion Open XDR 9.4 or later.

Users and system administrators, who want to deploy the Netsurion Open XDR sensors.

1. Account Logon ........................................................................................................................... 5

3. Detailed Tracking ..................................................................................................................... 13

4. DS Access ................................................................................................................................ 15

6. Object Access .......................................................................................................................... 27

7. Policy Change .......................................................................................................................... 39

10. Global Object Access Auditing ............................................................................................... 59

1. Account Logon

1.1 Audit Credential Validation (Enable/Enable)

credentials submitted for a user account logon request.

Default: Not configured.

request. Success audits record successful attempts and failure audits record unsuccessful attempts.

Event ID

4776

4777

Event volume: High on Kerberos Key Distribution Center servers.

Default: Not configured.

1.3 Account Logon - Audit Kerberos Service Ticket Operations

Applies to: Windows Server 2008 onwards and Windows 7 onwards.

This security policy setting determines whether the operating system generates security audit events

for Kerberos service ticket requests. Events are generated every time Kerberos is used to authenticate

a user to access a protected network resource.

Kerberos service ticket operation audit events can be used to track user activity.

Event volume:

submitted for a user account logon that are not credential validation or Kerberos tickets. Examples can

2. Account Management

2.1 Application Group Management

application group management tasks are performed, such as:

Event volume: Low.

Default: Not configured.

This security policy setting can be used to generate security audit events with detailed tracking

Detailed Directory Service Replication

4.2 Directory Service Access

Applies to: Windows Server 2008 onwards and Windows 7 onwards.

This security policy setting determines whether the operating system generates events when an Active

Directory Domain Services (AD DS) object is accessed.

NOTE: Audit events will only be generated on objects with configured system access control lists

(SACLs), and only when they are accessed in a manner that matches the SACL settings.

These events are like the Directory Service Access events in previous versions of Windows Server

operating systems.

4.4 Directory Service Replication

Applies to: Windows Server 2008 onwards and Windows 7 onwards.

This security policy setting determines whether the operating system generates audit events when

replication between two domain controllers begins and ends.

Event volume: Medium (DC’s); No Events on clients.

computer interactively or over a network. These events are particularly useful for tracking user activity

and identifying potential attacks on network resources.

This security policy setting allows you to audit security events generated by a failed attempt to log on

audits record unsuccessful attempts.

IPsec Extended Mode

of the Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AuthIP) during Main

Mode negotiations.

IPsec Quick Mode

5.5 Account Logoff

Applies to: Windows Server 2008 onwards and Windows 7 onwards.

This security policy setting determines whether the operating system generates audit events when

logon sessions are terminated. These events occur on the computer that was accessed. In the case of

an interactive logon, these would be generated on the computer that was logged on to.

Event ID

Event volume: Low

Default: Success

Also, refer to Event ID 4647 which Windows logs instead of this event in the case of interactive logons

when the user logs out.

This event signals the end of a logon session and can be correlated back to the logon event 4624 using

the Logon ID.

For network connections (such as to a file server), it will appear that users log on and off many times a

day. This phenomenon is caused by the way the Server service terminates idle connections.

if the computer is shut down or loses network connectivity it may not record a logoff event at all.

5.6 Account Logon

Applies to: Windows Server 2008 onwards and Windows 7 onwards.

This security policy setting determines whether the operating system generates audit events when a

user attempts to log on to a computer. These events are related to the creation of logon sessions and

occur on the computer that was accessed. For an interactive logon, events are generated on the

computer that was logged on to. For network logon, such as accessing a share, events are generated

on the computer hosting the resource that was accessed.

The following events are recorded:

log on an account by explicitly specifying that account's credentials. This most commonly occurs

in batch-type configurations such as scheduled tasks, or when using the Runas command.

5.7 Network Policy Server (NPS)

Applies to: Windows Server 2008 onwards and Windows 7 onwards.

This security policy setting determines whether the operating system generates audit events for

RADIUS (IAS) and Network Access Protection (NAP) activity on user access requests (Grant, Deny,

Discard, Quarantine, Lock, and Unlock).

Event volume: Medium–High (Servers running NPS); Medium on other Servers and client computers.

Default: Success / Failure.

Event Message

5.8 Other Logon/Logoff Events

Applies to: Windows Server 2008 onwards and Windows 7 onwards.

This security policy setting determines whether Windows generates audit events for other logon or

logoff events, such as:

identical information. This condition could also be caused by network misconfiguration.

connections are allowed or blocked by the Windows Filtering Platform, such as when:

Filtering Platform

Default setting: Not configured

Handle Manipulation

mutexes and semaphores. Only kernel objects with a matching system access control list (SACL)

Typically kernel objects are given SACLs only if the AuditBaseObjects or AuditBaseDirectories auditing

options are enabled.

Event volume: High, if you have enabled one of the Global Object Access Auditing settings

Default: Not configured.

Applies to: Windows Server 2008 onwards and Windows 7 onwards.

This security policy setting determines whether the operating system generates audit events for the

management of Task Scheduler jobs or COM+ objects.

Event volume: Low.

Default setting: Not configured.

registry objects. Audit events are only generated for objects that have configured system access

control lists (SACLs) specified, and only if the type of access requested (such as Write, Read, or Modify)

and the account making request match the settings in the SACL.

If success auditing is enabled, an audit entry is generated each time an account successfully accesses a

registry object that has a matching SACL. If failure auditing is enabled, an audit entry is generated each

time any user unsuccessfully attempts to access a registry object that has a matching SACL.

Event volume: Low – Medium (Depending on SACL configuration)

Default: Not Configured.

objects include the following:

If you configure this policy setting, an audit event is generated when a SAM object is accessed. Success

audits record successful attempts, and failure audits record unsuccessful attempts.

NOTE:

Only SACL for SAM_SERVER can be modified.

Changes to user and group objects are tracked by the Account Management audit category. However,

user accounts with enough privileges could potentially alter the files where the account and password

information are stored in the system, bypassing any Account Management events.

Event volume: High on domain controllers.

NOTE: For information about reducing the number of events generated in this subcategory, please

refer article 841001 in Microsoft Knowledge Base.

7. Policy Change

Policy Change audit events allow tracking changes to important security policies on a local system or

network. Because policies are typically established by administrators to help secure network resources,

any changes or attempts to change these policies can be an important aspect of security management

for a network.

for a file or registry key.)

NOTE:

SACL change auditing is performed when SACL for an object has changed and the Policy Change

category is configured. Discretionary access control list (DACL) and owner change auditing are

performed when Object Access auditing is configured and the object's SACL is set for auditing of the

DACL or owner change.

Changes made to the Special Groups list.

NOTE: Changes to the audit policy are critical security events.

Event volume: Low

Default: Success

7.2 Authentication Policy Change

Applies to: Windows Server 2008 onwards and Windows 7 onwards.

This security policy setting determines whether the operating system generates audit events when

4905

accounts or groups.

Event volume: Low

Default: Success

7.3 Authorization Policy Change

Applies to: Windows Server 2008 onwards and Windows 7 onwards.

This security policy setting determines whether the operating system generates audit events when the

following changes are made to the authorization policy:

subcategory.

Event ID

rights).

Event volume: Very high

Default: Not configured

Event volume: Very high

Default: Not configured

Event ID

Sensitive Privilege Use

8.3 Other Privilege Use Events

This security policy setting is not used in this version of Windows

Event volume: N/A

9. System

System security policy settings and audit events allow you to track system-level changes to a computer

9.1 IPSEC Driver

may not get the protection provided by the IPsec filter.

Default: Not configured

Ipsec Driver

IPsec dropped an inbound packet that failed a replay check. If this problem persists,

usually due to the remote computer changing its IPsec policy without informing this

also indicate interoperability problems with other IPsec implementations. In that

NOTE:

Failure to start the Windows Firewall service may result in a computer that is not fully protected

against network threats.

Event volume: Low

Default: Success and failure

Other System Events

9.3 Security State Change

Applies to: Windows Server 2008 onwards and Windows 7 onwards.

This security policy setting determines whether the operating system audits changes in the security

Some auditable activity may not be recorded when a system reboots due to CrashOnAuditFail.

System startup and shutdown events are important to understand system usage.

Event volume: Low

Default: Success

9.4 Security System Extension

Applies to: Windows Server 2008 onwards and Windows 7 onwards.

This security policy setting determines whether the operating system audits events related to security

system extensions, including any of the following events:

type, and service account

NOTE:

Event volume: Low

These events are expected to appear more on a domain controller than on client computers or

member servers.

address space, read to a client address space, or write from a client address space.

Default: Success and failure