Windows Advanced Auditing Recommendations

Advanced Audit Logging for better visibility using Domain Group Policy (Preferred)

As with all security settings, the best practice is to use Group Policy to centrally manage your audit policy. Using local settings can be risky: A group policy could override the local policy settings. Microsoft warns you of this behavior on each policy’s Local Security Setting tab shown below.

To configure audit settings on all domain clients:

· Go to Start Menu → Administrative Tools → Group Policy Management.

· In the left pane, navigate to Forest → Domains → Domain Name. Expand it.

· You can select either ‘Default Domain Policy’ or create a new Group Policy Object.

· Right-click on ‘Default Domain Policy’ or other Group Policy Object.

· Click ‘Edit’ in the context menu. It shows ‘Group Policy Management Editor’.

· Go to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies.

· Check Configure the following audit events -> Success -> OK.

Continue to follow similar steps to enable all the settings listed in Appendix A.

Advanced Audit Logging for better visibility – using Local Security Policy

(To be used only if configuring a Domain GPO is not an option)

A Windows system's audit policy determines which type of information about the system you'll find in the Security log. Windows uses nine audit policy categories and 50 audit policy subcategories to give you more-granular control over which information is logged.

Ø Open the Start Menu and type: gpedit.msc

Ø OR use the keyboard shortcut Windows Key + R and type: gpedit.msc in the Run line and hit Enter.

Ø To view a system’s audit policy settings, you can open the MMC Local Security Policy console on the system and drill down to gpedit Group Policy Editor, navigate to Windows Settings >> Security Settings >> Local Policy >> Audit Policy as shown below.

Ø From there, check the boxes to audit successful or failed audit attempts and click OK.

Alternatively, you may also use Auditpol (Command line utility) to determine which subcategories are being audited. If you are performing a baseline of a system, Auditpol gives you the ability to see what is really happening. Take a look at an example of what you will see when you use the auditpol /get /category:* command.

Below are the list of commands that should be run in order to enable the Audit policies using auditpol utility.

:: CAPTURE THE SETTINGS - BEFORE they have been modified

:: ------------------------------------------------------------------------------------------------------------------------------

Auditpol /get /category:* > AuditPol_BEFORE_%computername%.txt


:: To Track Account Logon Activities

:: ------------------------------------------------------------------------------------------------------------------------------

Auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable

Auditpol /set /subcategory:"Kerberos Authentication Service" /success:disable /failure:disable

Auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:disable /failure:disable

Auditpol /set /subcategory:"Other Account Logon Events" /success:enable /failure:enable


:: To Track Account Management

:: ------------------------------------------------------------------------------------------------------------------------------

:: Sets - the entire category - Auditpol /set /category:"Account Management" /success:enable /failure:enable


Auditpol /set /subcategory:"Application Group Management" /success:disable /failure:disable

Auditpol /set /subcategory:"Computer Account Management" /success:enable /failure:enable

Auditpol /set /subcategory:"Distribution Group Management" /success:enable /failure:enable

Auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable

Auditpol /set /subcategory:"Other Account Management Events" /success:enable /failure:enable

Auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable


:: Detailed Tracking

:: ------------------------------------------------------------------------------------------------------------------------------

Auditpol /set /subcategory:"Process Termination" /success:enable /failure:enable

Auditpol /set /subcategory:"DPAPI Activity" /success:disable /failure:disable

Auditpol /set /subcategory:"RPC Events" /success:enable /failure:enable

Auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable


:: To Track Directory Service Access

:: ------------------------------------------------------------------------------------------------------------------------------

Auditpol /set /subcategory:"Detailed Directory Service Replication" /success:disable /failure:disable

Auditpol /set /subcategory:"Directory Service Access" /success:disable /failure:disable

Auditpol /set /subcategory:"Directory Service Changes" /success:enable /failure:enable

Auditpol /set /subcategory:"Directory Service Replication" /success:disable /failure:disable


:: To Track Logon/Logoff Activities

:: ------------------------------------------------------------------------------------------------------------------------------

Auditpol /set /subcategory:"Account Lockout" /success:enable /failure:disable

Auditpol /set /subcategory:"IPsec Extended Mode" /success:disable /failure:disable

Auditpol /set /subcategory:"IPsec Main Mode" /success:disable /failure:disable

Auditpol /set /subcategory:"IPsec Quick Mode" /success:disable /failure:disable

Auditpol /set /subcategory:"Logoff" /success:enable /failure:disable

Auditpol /set /subcategory:"Logon" /success:enable /failure:enable

Auditpol /set /subcategory:"Network Policy Server" /success:disable /failure:disable

Auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable

Auditpol /set /subcategory:"Special Logon" /success:enable /failure:disable


:: To Track Object Access

:: ------------------------------------------------------------------------------------------------------------------------------

Auditpol /set /subcategory:"Application Generated" /success:enable /failure:enable

Auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable

Auditpol /set /subcategory:"Detailed File Share" /success:enable

:: Note: Will generate a lot of events if Files and Reg keys are audited so only audit locations that are not noisy

Auditpol /set /subcategory:"File Share" /success:enable /failure:enable

Auditpol /set /subcategory:"File System" /success:enable /failure:enable

Auditpol /set /subcategory:"Removable Storage" /success:enable /failure:enable


:: To Track Policy Changes

:: ------------------------------------------------------------------------------------------------------------------------------

Auditpol /set /subcategory:"Audit Policy Change" /success:enable /failure:enable

Auditpol /set /subcategory:"Authentication Policy Change" /success:enable /failure:disable

Auditpol /set /subcategory:"Authorization Policy Change" /success:enable /failure:enable


:: Note: Enable if you use Windows Firewall to monitor changes


Auditpol /set /subcategory:"Filtering Platform Policy Change" /success:disable /failure:disable

Auditpol /set /subcategory:"MPSSVC Rule-Level Policy Change" /success:disable /failure:disable

Auditpol /set /subcategory:"Other Policy Change Events" /success:disable /failure:disable

:: To Track Privilege Use

:: ------------------------------------------------------------------------------------------------------------------------------

Auditpol /set /subcategory:"Other Privilege Use Events" /success:disable /failure:disable

Auditpol /set /subcategory:"Non Sensitive Privilege Use" /success:disable /failure:disable

Auditpol /set /subcategory:"Sensitive Privilege Use" /success:enable /failure:enable

:: To Track SYSTEM events

:: ------------------------------------------------------------------------------------------------------------------------------

Auditpol /set /subcategory:"IPsec Driver" /success:enable /failure:enable

Auditpol /set /subcategory:"Other System Events" /success:enable /failure:enable

Auditpol /set /subcategory:"Security State Change" /success:enable /failure:enable

Auditpol /set /subcategory:"Security System Extension" /success:enable /failure:enable

Auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable

:: CAPTURE THE SETTINGS - AFTER they have been modified

:: ------------------------------------------------------------------------------------------------------------------------------

Auditpol /get /category:* > AuditPol_AFTER_%computername%.txt

Last updated