Servers Enhanced Auditing Policy | |
Data collected on: 7/27/2017 8:05:34 AM |
Domain | windomain.local |
Owner | WINDOMAIN\vagrant |
Created | 7/26/2017 8:25:20 PM |
Modified | 7/26/2017 8:25:22 PM |
User Revisions | 1 (AD), 1 (SYSVOL) |
Computer Revisions | 1 (AD), 1 (SYSVOL) |
Unique ID | {FEFE7A78-C5E6-4A09-A4E3-24590785DFFA} |
GPO Status | User settings disabled |
Location | Enforced | Link Status | Path |
---|---|---|---|
Servers | Yes | Enabled | windomain.local/Servers |
Name |
---|
NT AUTHORITY\Authenticated Users |
Name | Allowed Permissions | Inherited |
---|---|---|
NT AUTHORITY\Authenticated Users | Read (from Security Filtering) | No |
NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS | Read | No |
NT AUTHORITY\SYSTEM | Edit settings, delete, modify security | No |
WINDOMAIN\Domain Admins | Edit settings, delete, modify security | No |
WINDOMAIN\Enterprise Admins | Edit settings, delete, modify security | No |
WINDOMAIN\vagrant | Edit settings, delete, modify security | No |
Policy | Setting |
---|---|
Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings | Enabled |
Group | Members | Member of |
---|---|---|
BUILTIN\Event Log Readers | NT AUTHORITY\NETWORK SERVICE |
Policy | Setting |
---|---|
Policy version | 2.22 |
Disable stateful FTP | Not Configured |
Disable stateful PPTP | Not Configured |
IPsec exempt | Not Configured |
IPsec through NAT | Not Configured |
Preshared key encoding | Not Configured |
SA idle time | Not Configured |
Strong CRL check | Not Configured |
Name | Description | ||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Windows Remote Management (HTTP-In) | Inbound rule for Windows Remote Management via WS-Management. [TCP 5985] | ||||||||||||||||||||||||||||||||||||
|
Policy | Setting |
---|---|
Audit Credential Validation | Success, Failure |
Audit Other Account Logon Events | Success, Failure |
Policy | Setting |
---|---|
Audit Security Group Management | Success, Failure |
Audit User Account Management | Success, Failure |
Policy | Setting |
---|---|
Audit DPAPI Activity | Success, Failure |
Audit PNP Activity | Success, Failure |
Audit Process Creation | Success, Failure |
Audit Process Termination | Success, Failure |
Policy | Setting |
---|---|
Audit Account Lockout | Success, Failure |
Audit User / Device Claims | Success, Failure |
Audit Group Membership | Success, Failure |
Audit Logoff | Success, Failure |
Audit Logon | Success, Failure |
Audit Other Logon/Logoff Events | Success, Failure |
Audit Special Logon | Success, Failure |
Policy | Setting |
---|---|
Audit Detailed File Share | Success, Failure |
Audit File Share | Success, Failure |
Audit File System | Success, Failure |
Audit Filtering Platform Connection | Failure |
Audit Other Object Access Events | Success, Failure |
Audit Registry | Success, Failure |
Audit Removable Storage | Success, Failure |
Policy | Setting |
---|---|
Audit Audit Policy Change | Success, Failure |
Audit Authentication Policy Change | Success, Failure |
Audit MPSSVC Rule-Level Policy Change | Success, Failure |
Audit Other Policy Change Events | Success, Failure |
Policy | Setting |
---|---|
Audit Non Sensitive Privilege Use | Failure |
Audit Sensitive Privilege Use | Success, Failure |
Policy | Setting |
---|---|
Audit Other System Events | Success, Failure |
Audit Security State Change | Success, Failure |
Audit Security System Extension | Success, Failure |
Audit System Integrity | Success, Failure |
Policy | Setting | Comment |
---|---|---|
Include command line in process creation events | Enabled |
Policy | Setting | Comment | ||
---|---|---|---|---|
Back up log automatically when full | Disabled | |||
Control Event Log behavior when the log file reaches its maximum size | Disabled | |||
Specify the maximum log file size (KB) | Enabled | |||
|
Policy | Setting | Comment | ||
---|---|---|---|---|
Back up log automatically when full | Disabled | |||
Control Event Log behavior when the log file reaches its maximum size | Disabled | |||
Specify the maximum log file size (KB) | Enabled | |||
|
Policy | Setting | Comment | ||
---|---|---|---|---|
Back up log automatically when full | Disabled | |||
Control Event Log behavior when the log file reaches its maximum size | Disabled | |||
Specify the maximum log file size (KB) | Enabled | |||
|
Policy | Setting | Comment | ||
---|---|---|---|---|
Turn on Script Execution | Enabled | |||
|
Policy | Setting | Comment |
---|---|---|
Allow Remote Shell Access | Enabled |
Action | Update |
Hive | HKEY_LOCAL_MACHINE |
Key path | SYSTEM\CurrentControlSet\Control\Lsa |
Value name | RestrictRemoteSamEventThrottlingWindow |
Value type | REG_DWORD |
Value data | 0x0 (0) |
Stop processing items on this extension if an error occurs on this item | No |
Remove this item when it is no longer applied | No |
Apply once and do not reapply | No |