# Windows Advanced Auditing Recommendations

As with all security settings, the best practice is to use Group Policy to centrally manage your audit policy. Using local settings can be risky: A group policy could override the local policy settings. Microsoft warns you of this behavior on each policy’s Local Security Setting tab shown below.

To configure audit settings on all domain clients:

·      Go to Start Menu → Administrative Tools → Group Policy Management.

·      In the left pane, navigate to Forest → Domains → Domain Name. Expand it.

·      You can select either ‘Default Domain Policy’ or create a new Group Policy Object.

·      Right-click on ‘Default Domain Policy’ or other Group Policy Object.

·      Click ‘Edit’ in the context menu. It shows ‘Group Policy Management Editor’.

![](/files/-MMSsoJvniYbD8RrBPA9)

·      Go to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies.&#x20;

![](/files/-MMSt0duv1HGRK9Bb3Xm)

·      Check Configure the following audit events -> Success -> OK.

![](/files/-MMStE7vz-B9_eJE6F89)

Continue to follow similar steps to enable all the settings listed in Appendix A.

## Advanced Audit Logging for better visibility – using Local Security Policy

(To be used only if configuring a Domain GPO is not an option)

A Windows system's audit policy determines which type of information about the system you'll find in the Security log. Windows uses nine audit policy categories and 50 audit policy subcategories to give you more-granular control over which information is logged.

Ø  Open the Start Menu and type: gpedit.msc

Ø  OR use the keyboard shortcut Windows Key + R and type: gpedit.msc in the Run line and hit Enter.

![](/files/-MMStUMUVwIs2KfX4EfH)

Ø  To view a system’s audit policy settings, you can open the MMC Local Security Policy console on the system and drill down to gpedit Group Policy Editor, navigate to Windows Settings >> Security Settings >> Local Policy >> Audit Policy as shown below.

![](/files/-MMSteIPVBxPDOxwv4ef)

Ø  From there, check the boxes to audit successful or failed audit attempts and click OK.

![](/files/-MMStscgZfumdNQmXULs)

Alternatively, you may also use **Auditpol (Command line utility)** to determine which subcategories are being audited. If you are performing a baseline of a system, **Auditpol** gives you the ability to see what is really happening. Take a look at an example of what you will see when you use the `auditpol /get /category:*` command.

![](/files/-MMSu4SdbKxOH2_oyDoz)

Below are the list of commands that should be run in order to enable the Audit policies using **auditpol** utility.

| <p><strong>:: CAPTURE THE SETTINGS - BEFORE they have been modified</strong></p><p>:: ------------------------------------------------------------------------------------------------------------------------------</p><p><code>Auditpol /get /category:\* > AuditPol\_BEFORE\_%computername%.txt</code></p><p>::</p><p><strong>:: To Track Account Logon Activities</strong></p><p>:: ------------------------------------------------------------------------------------------------------------------------------</p><p><code>Auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable</code></p><p><code>Auditpol /set /subcategory:"Kerberos Authentication Service" /success:disable /failure:disable</code></p><p><code>Auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:disable /failure:disable</code></p><p><code>Auditpol /set /subcategory:"Other Account Logon Events" /success:enable /failure:enable</code></p><p>::</p><p><strong>:: To Track Account Management</strong></p><p>:: ------------------------------------------------------------------------------------------------------------------------------</p><p>:: Sets - the entire category - <code>Auditpol /set /category:"Account Management" /success:enable /failure:enable</code></p><p>::</p><p><code>Auditpol /set /subcategory:"Application Group Management" /success:disable /failure:disable</code></p><p><code>Auditpol /set /subcategory:"Computer Account Management" /success:enable /failure:enable</code></p><p><code>Auditpol /set /subcategory:"Distribution Group Management" /success:enable /failure:enable</code></p><p><code>Auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable</code></p><p><code>Auditpol /set /subcategory:"Other Account Management Events" /success:enable /failure:enable</code></p><p><code>Auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable</code></p><p>::</p><p>:: <strong>Detailed Tracking</strong></p><p>:: ------------------------------------------------------------------------------------------------------------------------------</p><p><code>Auditpol /set /subcategory:"Process Termination" /success:enable /failure:enable</code></p><p><code>Auditpol /set /subcategory:"DPAPI Activity" /success:disable /failure:disable</code></p><p><code>Auditpol /set /subcategory:"RPC Events" /success:enable /failure:enable</code></p><p><code>Auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable</code></p><p>::</p><p>:: <strong>To Track Directory Service Access</strong></p><p>:: ------------------------------------------------------------------------------------------------------------------------------</p><p><code>Auditpol /set /subcategory:"Detailed Directory Service Replication" /success:disable /failure:disable</code></p><p><code>Auditpol /set /subcategory:"Directory Service Access" /success:disable /failure:disable</code></p><p><code>Auditpol /set /subcategory:"Directory Service Changes" /success:enable /failure:enable</code></p><p><code>Auditpol /set /subcategory:"Directory Service Replication" /success:disable /failure:disable</code></p><p>::</p><p>:: <strong>To Track Logon/Logoff Activities</strong></p><p>:: ------------------------------------------------------------------------------------------------------------------------------</p><p><code>Auditpol /set /subcategory:"Account Lockout" /success:enable /failure:disable</code></p><p><code>Auditpol /set /subcategory:"IPsec Extended Mode" /success:disable /failure:disable</code></p><p><code>Auditpol /set /subcategory:"IPsec Main Mode" /success:disable /failure:disable</code></p><p><code>Auditpol /set /subcategory:"IPsec Quick Mode" /success:disable /failure:disable</code></p><p><code>Auditpol /set /subcategory:"Logoff" /success:enable /failure:disable</code></p><p><code>Auditpol /set /subcategory:"Logon" /success:enable /failure:enable</code></p><p><code>Auditpol /set /subcategory:"Network Policy Server" /success:disable /failure:disable</code></p><p><code>Auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable</code></p><p><code>Auditpol /set /subcategory:"Special Logon" /success:enable /failure:disable</code></p><p>::</p><p>:: <strong>To Track Object Access</strong></p><p>:: ------------------------------------------------------------------------------------------------------------------------------</p><p><code>Auditpol /set /subcategory:"Application Generated" /success:enable /failure:enable</code></p><p><code>Auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable</code></p><p><code>Auditpol /set /subcategory:"Detailed File Share" /success:enable</code></p><p></p><p>::  <strong>Note:</strong> Will generate a lot of events if Files and Reg keys are audited so only audit locations that are not noisy</p><p>                </p><p><code>Auditpol /set /subcategory:"File Share" /success:enable /failure:enable</code></p><p><code>Auditpol /set /subcategory:"File System" /success:enable /failure:enable</code></p><p><code>Auditpol /set /subcategory:"Removable Storage" /success:enable /failure:enable</code></p><p>::</p><p>:: <strong>To Track Policy Changes</strong></p><p>:: ------------------------------------------------------------------------------------------------------------------------------</p><p><code>Auditpol /set /subcategory:"Audit Policy Change" /success:enable /failure:enable</code></p><p><code>Auditpol /set /subcategory:"Authentication Policy Change" /success:enable /failure:disable</code></p><p><code>Auditpol /set /subcategory:"Authorization Policy Change" /success:enable /failure:enable</code></p><p>::</p><p>:: Note:  Enable if you use Windows Firewall to monitor changes</p><p>::</p><p><code>Auditpol /set /subcategory:"Filtering Platform Policy Change" /success:disable /failure:disable</code></p><p><code>Auditpol /set /subcategory:"MPSSVC Rule-Level Policy Change" /success:disable /failure:disable</code></p><p><code>Auditpol /set /subcategory:"Other Policy Change Events" /success:disable /failure:disable</code></p><p></p><p>:: <strong>To Track Privilege Use</strong></p><p>:: ------------------------------------------------------------------------------------------------------------------------------</p><p><code>Auditpol /set /subcategory:"Other Privilege Use Events" /success:disable /failure:disable</code></p><p><code>Auditpol /set /subcategory:"Non Sensitive Privilege Use" /success:disable /failure:disable</code></p><p><code>Auditpol /set /subcategory:"Sensitive Privilege Use" /success:enable /failure:enable</code></p><p></p><p>:: <strong>To Track SYSTEM events</strong></p><p>:: ------------------------------------------------------------------------------------------------------------------------------</p><p><code>Auditpol /set /subcategory:"IPsec Driver" /success:enable /failure:enable</code></p><p><code>Auditpol /set /subcategory:"Other System Events" /success:enable /failure:enable</code></p><p><code>Auditpol /set /subcategory:"Security State Change" /success:enable /failure:enable</code></p><p><code>Auditpol /set /subcategory:"Security System Extension" /success:enable /failure:enable</code></p><p><code>Auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable</code></p><p></p><p>:: <strong>CAPTURE THE SETTINGS - AFTER they have been modified</strong></p><p>:: ------------------------------------------------------------------------------------------------------------------------------</p><p><code>Auditpol /get /category:\* > AuditPol\_AFTER\_%computername%.txt</code></p><p></p> |
| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.blusapphire.io/16_best-practices/windows-logging-recommendations/windows-advanced-auditing-recommendations.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.