Auditing security events

You can set up audit policy so that user or system activity in specified event categories is recorded. You can monitor security-related activity, such as who accesses an object, if a user logs on to or logs off from a computer, or if changes are made to an auditing policy setting.

  • Before defining auditing policy settings in the object access event category, see Checklist: Setting up object access auditing.
  • For tips about auditing, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.


Checklist: Setting up object access auditing

Step | Reference
Read the auditing overview. | Auditing overview
Enable auditing of the object access event category. | To define or modify auditing policy settings for an event category
Apply auditing policy to a specified object. | To apply or modify auditing policy settings for a local file or folder; To apply or modify auditing policy settings for an object using Group Policy


Best practices

Create an audit plan before implementing audit policy.

  • Decide what type of information you want to gain by collecting audit events:
    • If you are interested in intrusion detection—tracking the attempts of users to gain access to areas for which they are not authorized—you can collect failure audits. But enabling failure audits can be a risk to your organization. If users attempt to access a resource for which they are not authorized, they can create so many failure audits that the security log becomes full, and the computer cannot collect any more audits. If you have the Audit: Shut down system immediately if unable to log security audits policy setting enabled, users can start a denial-of-service attack through your audit policy.
    • If you are interested in forensics—using the audit log to determine exactly what happens in your organization—you can collect a combination of success and failure audits.
  • Consider the resources that you have available for collecting and reviewing an audit log. Audit events take up space on your computers, and they take up your time and the time of people in your organization. Do not audit events that do not really interest you.

Collect and archive security logs across your organization.

  • If an intrusion occurs, isolate and preserve the security log entries. These entries can be valuable during an investigation of the intrusion.
  • An audit trail can contain information about changes that are made to your computer or to other computers on the network. If intruders gain administrator rights and permissions, or if administrators abuse their rights and permissions, they can clear the security log, leaving you without a trail of their actions. If you use a tool that regularly collects and saves security log entries across your organization, even if intruders or administrators clear the local security log, you are more likely to be able to trace the actions of intruders or administrators. Microsoft Operations Manager is an example of such a tool. For the most recent tools available, see Search Microsoft.com at the Microsoft Web site. (http://www.microsoft.com/)

Audit success and failure events in the system event category.

  • By auditing success and failure events in the system event category, you can notice unusual activity that may indicate that an intruder is attempting to gain access to your computer or your network.
  • The number of audits that are generated when this setting is enabled tends to be relatively low, and the quality of information that is gained from the events tends to be relatively high.

    • For information about the system event category, see Audit system events.

    For information about how to enable auditing in the system event category, see To define or modify auditing policy settings for an event category.

Audit success events in the policy change event category on domain controllers.

  • If an event is logged in the policy change event category, someone has changed the Local Security Authority (LSA) security policy configuration.
  • If you use Group Policy to edit your auditing policy settings, it is not necessary to audit events in the policy change event category on member servers.
  • If you decide to audit failure events in the policy change event category, you can see if unauthorized users or attackers are trying to change policy settings, including security policy settings. Although this can be helpful for intrusion detection, the increase in resources that is required and the possibility of a denial-of-service attack usually outweigh the benefits.

    • For information about the policy change event category, see Audit policy change.

    For information about how to enable auditing in the policy change event category, see To define or modify auditing policy settings for an event category.

Audit success events in the account management event category.

  • By auditing success events in the account management event category, you can verify changes that are made to account properties and group properties.
  • If you decide to audit failure events in the account management event category, you can see if unauthorized users or attackers are trying to change account properties or group properties. Although this can be helpful for intrusion detection, the increase in resources that is required and the possibility of a denial-of-service attack usually outweigh the benefits.

    • For information about the account management event category, see Audit account management.

    For information about how to enable auditing in the account management event category, see To define or modify auditing policy settings for an event category.

Audit success events in the logon event category.

  • By auditing success events in the logon event category, you have a record of when each user logs on to or logs off from a computer. If an unauthorized person steals a user's password and logs on to a computer, you can determine when the breach of security occurred.
  • If you decide to audit failure events in the logon event category, you can see if unauthorized users or attackers are trying to log on to a computer. Although this can be helpful for intrusion detection, the possibility of a denial-of-service attack increases with the auditing of failure events in the logon event category. Users who are outside your organization can cause these events to be logged, and as a result they can shut down your network.

    • For information about how to enable auditing in the logon event category, see To define or modify auditing policy settings for an event category.

Audit success events in the account logon event category on domain controllers.

  • By auditing success events in the account logon event category, you can see when users log on to or log off from the domain.
  • It is not necessary to audit events in the account logon event category on member servers.
  • If you decide to audit failure events in the account logon event category, you can see if unauthorized users or attackers are trying to log on to your network. Although this can be helpful for intrusion detection, the possibility of a denial-of-service attack increases with the auditing of failure events in the account logon event category. Users who are outside your organization can cause these events to be logged, and as a result they can shut down your network.

    • For information about the account logon event category, see Audit account logon events.

    For information about how to enable auditing in the account logon event category, see To define or modify auditing policy settings for an event category.

Be specific when setting up auditing on an object.

  • To audit object access, you must enable the Audit object access policy setting and then edit the system access control list (SACL) that is associated with the object. For more information, see Checklist: Setting up object access auditing.
  • For best system performance, minimize the number of entries in the SACL for an object. One entry in a SACL that contains 1000 users does not degrade system performance as much as 1000 separate entries.
  • To reduce the volume of events that is generated and to maximize the effectiveness of each event, only audit the actions that really interest you. For example, if you are interested in users reading a file, do not audit Full Control.

    • For information about the object access event category, see Audit object access.

    For information about operation-based auditing, see Operation-based auditing on files and folders.

    For information about how to enable auditing in the object access event category, see To define or modify auditing policy settings for an event category.

Set an appropriate size for the security log.

  • It is important that the size of the security log be configured appropriately, based on the number of events that your auditing policy settings generate.

    • For information about managing event logs, see Event Viewer.

    For information about settings for the event logs, see Settings for event logs.


How to...

  • Define or modify auditing policy settings for an event category
  • Apply or modify auditing policy settings for a local file or folder
  • Apply or modify auditing policy settings for an object using Group Policy
  • View the security log


Define or modify auditing policy settings for an event category

Microsoft Windows graphic

To define or modify auditing policy settings for an event category

For your local computer

  1. Open Local Security Settings.
  2. In the console tree, click Audit Policy.

    3. Where?

    • Security Settings
    • Local Policies
    • Audit Policy
  3. In the details pane, double-click an event category that you want to change the auditing policy settings for.
  4. Do one or both of the following, and then click OK.
    • To audit successful attempts, select the Success check box.
    • To audit unsuccessful attempts, select the Failure check box.

Notes

  • XOX
  • XOX

For only domain controllers, when you are on a domain controller or on a workstation that has Windows Server 2003 Administration Tools Pack installed

  1. Open Domain Controller Security Policy.
  2. In the console tree, click Audit Policy.

    3. Where?

    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Local Policies
    • Audit Policy
  3. In the details pane, double-click an event category that you want to change the auditing policy settings for.
  4. If you are defining auditing policy settings for this event category for the first time, select the Define these policy settings check box.
  5. Do one or both of the following, and then click OK.
    • To audit successful attempts, select the Success check box.
    • To audit unsuccessful attempts, select the Failure check box.

Notes

  • XOX
  • XOX

For a domain or organizational unit, when you are on a domain controller or on a workstation that has Administration Tools Pack installed

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the domain or organizational unit for which you want to set Group Policy.
  3. Click Properties, and then click the Group Policy tab.
  4. Click Edit to open the Group Policy object (GPO) that you want to edit. You can also click New to create a new GPO, and then click Edit.
  5. In the console tree, click Audit Policy.

    6. Where?

    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Local Policies
    • Audit Policy
  6. In the details pane, double-click an event category that you want to change the auditing policy settings for.
  7. If you are defining auditing policy settings for this event category for the first time, select the Define these policy settings check box.
  8. Do one or both of the following, and then click OK.
    • To audit successful attempts, select the Success check box.
    • To audit unsuccessful attempts, select the Failure check box.

Notes

  • XOX
  • XOX

For a domain or organizational unit, when you are on a member server or on a workstation that is joined to a domain

  1. Open Microsoft Management Console (MMC).
  2. In the File menu, click Add/Remove Snap-in, and then click Add.
  3. Click Group Policy Object Editor, and then click Add.
  4. On the Select Group Policy Object page in the Group Policy Wizard, click Browse.
  5. In Browse for a Group Policy Object, select a Group Policy object (GPO) in the appropriate domain, site, or organizational unit—or create a new one, click OK, and then click Finish.
  6. Click Close, and then click OK.
  7. In the console tree, click Audit Policy.

    8. Where?

    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Local Policies
    • Audit Policy
  8. In the details pane, double-click an event category that you want to change the auditing policy settings for.
  9. If you are defining auditing policy settings for this event category for the first time, select the Define these policy settings check box.
  10. Do one or both of the following, and then click OK.
    • To audit successful attempts, select the Success check box.
    • To audit unsuccessful attempts, select the Failure check box.

Notes

  • XOX
  • XOX

Notes

  • To audit object accesses, enable auditing of the object access event category by following the steps above. Then, enable auditing on the specific object. For information about how to enable auditing on an object, see "Apply or modify auditing policy settings for a local file or folder" or "Apply or modify auditing policy settings for an object using Group Policy" in Related Topics.
  • After your audit policy is configured, events will be recorded in the security log. Open the security log to view these events. For information about the security log, see "Use the security log" in Related Topics.
  • The default auditing policy setting for domain controllers is No Auditing. This means that even if auditing is enabled in the domain, the domain controllers do not inherit auditing policy locally. If you want domain auditing policy to apply to domain controllers, you must modify this policy setting.

Related Topics


Apply or modify auditing policy settings for a local file or folder

Microsoft Windows Graphic

To apply or modify auditing policy settings for a local file or folder

  1. Open Windows Explorer.
  2. Right-click the file or folder that you want to audit, click Properties, and then click the Security tab.
  3. Click Advanced, and then click the Auditing tab.
  4. Do one of the following:
    • To set up auditing for a new user or group, click Add. In Enter the object name to select, type the name of the user or group that you want, and then click OK.
    • To remove auditing for an existing group or user, click the group or user name, click Remove, click OK, and then skip the rest of this procedure.
    • To view or change auditing for an existing group or user, click its name, and then click Edit.
  5. In the Apply onto box, click the location where you want auditing to take place.
  6. In the Access box, indicate what actions you want to audit by selecting the appropriate check boxes:
    • To audit successful events, select the Successful check box.
    • To stop auditing successful events, clear the Successful check box.
    • To audit unsuccessful events, select the Failed check box.
    • To stop auditing unsuccessful events, clear the Failed check box.
    • To stop auditing all events, click Clear All.
  7. If you want to prevent subsequent files and subfolders of the original object from inheriting these audit entries, select the Apply these auditing entries to objects and/or containers within this container only check box.

Important

  • Before setting up auditing for files and folders, you must enable object access auditing by defining auditing policy settings for the object access event category. If you do not enable object access auditing, you will receive an error message when you set up auditing for files and folders, and no files or folders will be audited. For more information about how to enable object access auditing, see "Define or modify auditing policy settings for an event category" in Related Topics.

Notes

  • You must be logged on as a member of the Administrators group or you must have been granted the Manage auditing and security log right in Group Policy to perform this procedure.
  • XOX
  • For information about how to audit local registry keys, see "Audit activity on a registry key" in Related Topics.
  • After object access auditing is enabled, view the security log in Event Viewer to review the results of your changes.
  • You can set up file and folder auditing only on NTFS drives.
  • If you see the following:
    • In the Auditing Entry for File or Folder dialog box, in the Access box, the check boxes are unavailable …
    • In the Advanced Security Settings for File or Folder dialog box, the Remove button is unavailable …
    auditing has been inherited from the parent folder.
  • Because the security log is limited in size, select the files and folders to be audited carefully. Also, consider the amount of disk space that you want to devote to the security log. The maximum size for the security log is defined in Event Viewer.

Related Topics


Apply or modify auditing policy settings for an object using Group Policy

Microsoft Windows Graphic

To apply or modify auditing policy settings for an object using Group Policy

  1. Open Microsoft Management Console (MMC).
  2. On the File menu, click Add/Remove Snap-in, and then click Add.
  3. Click Group Policy Object Editor, and then click Add.
  4. On the Select Group Policy Object page in the Group Policy Wizard, click Browse.
  5. In Browse for a Group Policy Object, select a Group Policy object (GPO) in the appropriate domain, site, or organizational unit—or create a new one, click OK, and then click Finish.
  6. Click Close, and then click OK.
  7. Do one or more of the following:
    8. To audit Do this
    System services
    • In the console tree, click System Services.

      • Where?

      • Computer Configuration
      • Windows Settings
      • Security Settings
      • System Services
    • In the details pane, right-click the service that you want to apply or modify auditing policy settings for, and then click Properties.
    • If it is not already selected, select the Define this policy setting check box, and then select the appropriate setting.
    • Click Edit security.
    Registry keys In the console tree, click Registry.

    Where?

    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Registry
    • If you want to add a registry key to this GPO to audit, right-click Registry, and then click Add Key. Browse to the key that you want, and then click OK.
    • If you want to apply or modify auditing settings on a registry key that has already been added to this GPO, in the details pane, right-click the registry key, click Properties, and then click Edit Security.
    Files or folders In the console tree, click File System.

    Where?

    • Computer Configuration
    • Windows Settings
    • Security Settings
    • File System
    • If you want to add a file or folder to this GPO to audit, right-click File System, and then click Add File. Browse to the file that you want, or make a new folder, and then click OK.
    • If you want to apply or modify auditing settings on a file or folder that has already been added to this GPO, in the details pane, right-click the file or folder, click Properties, and then click Edit Security.
  8. Click Advanced, and then click the Auditing tab.
  9. Do one of the following:
    • To set up auditing for a new user or group, click Add. In Name, type the name of the user or group that you want, and then click OK.
    • To view or change auditing for an existing group or user, click the name that you want, and then click Edit.
    • To remove auditing for an existing group or user, click the name that you want, click Remove, click OK, and then skip the rest of this procedure.
  10. Select the appropriate entry in the Apply onto list.
  11. In the Access box, indicate what actions you want to audit by selecting the appropriate check boxes:
    • To audit successful events, select the Successful check box.
    • To stop auditing successful events, clear the Successful check box.
    • To audit unsuccessful events, select the Failed check box.
    • To stop auditing unsuccessful events, clear the Failed check box.
    • To stop auditing all events, click Clear All.
  12. If you want to prevent files and subfolders in the tree from inheriting these audit entries, select the Apply these auditing entries to objects and/or containers within this container only check box.

Important

  • Before setting up auditing for files and folders, you must enable object access auditing by defining auditing policy settings for the object access event category. If you do not enable object access auditing, you will receive an error message when you set up auditing for files and folders, and no files or folders will be audited. For more information about how to enable object access auditing, see "Define or modify auditing policy settings for an event category" in Related Topics.

Notes

  • XOX
  • XOX
  • For more information on selecting where to apply auditing entries, see Related Topics.
  • You can set up file and folder auditing only on NTFS drives.
  • If you see the following:
    • In the Auditing Entry for File or Folder dialog box, in the Access box, the check boxes are unavailable …
    • In the Advanced Security Settings for File or Folder dialog box, the Remove button is unavailable …
    auditing is inherited from the parent folder.
  • After object access auditing is enabled, view the security log in Event Viewer to review the results of your changes.
  • Because the security log is limited in size, select the files and folders to be audited carefully. Also, consider the amount of disk space that you want to devote to the security log. The maximum size for the security log is defined in Event Viewer.

Related Topics


View the security log

Microsoft Windows graphic

To view the security log

  1. Open Event Viewer.
  2. In the console tree, click Security. The details pane lists individual security events.
  3. If you want to see more details about a specific event, in the details pane, double-click the event.

Notes

  • XOX
  • XOX
  • For more information about security events, see "Security Events" at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/)

Related Topics


Concepts

This section provides general background information about auditing:

  • Auditing overview
  • Viewing security logs
  • Operation-based auditing on files and folders
  • Auditing settings on objects
  • How inheritance affects file and folder auditing
  • Selecting where to apply auditing entries
  • Per-user selective auditing


Auditing overview

Establishing audit policy is an important facet of security. Monitoring the creation or modification of objects gives you a way to track potential security problems, helps to ensure user accountability, and provides evidence in the event of a security breach.

The most common types of events to be audited are:

  • Access to objects, such as files and folders.
  • Management of user accounts and group accounts.
  • Users logging on to and logging off from the system.

When you implement audit policy:

  • Specify the categories of events that you want to audit. Examples of event categories are user logon, user logoff, and account management. The event categories that you select constitute your audit policy. For more information about each event category, see Auditing policy.
  • Set the size and behavior of the security log. You can view the security log with Event Viewer. For more information about the security log, see Viewing security logs.
  • If you want to audit directory service access or object access, determine which objects you want to monitor access of and what type of access you want to monitor. For example, if you want to audit any attempts by users to open a particular file, you can configure auditing policy settings in the object access event category so that both successful and failed attempts to read a file are recorded.

    For more information about how to set up object access auditing, see:

    • To apply or modify auditing policy settings for a local file or folder
    • To apply or modify auditing policy settings for an object using Group Policy

For more information about auditing, see Auditing security events.


Viewing security logs

Auditing a local object creates an entry in the security log. The security entries that appear in the security log depend on the auditing categories that you select for your audit policy. For events that are related to object access, the entries in the security log also depend on the auditing policy settings that are defined for each object. For more information about auditing, see Auditing security events.

For example, if your audit policy specifies the auditing of files and folders, and a file's properties specify that failed deletions of that file are to be audited, each failed attempt by a user to delete the file appears in the security log.

You can view the security log by using Event Viewer.

Size of the security log

It is important that you set the size of the security log appropriately. Because the security log is limited in size, choose which events you audit carefully. Also, consider the amount of disk space that you are willing to devote to the security log. The maximum amount is defined in Event Viewer.

For information on what to do when the security log is full, see Audit: Shut down system immediately if unable to log security audits.

For more information about security events, see "Security Events" at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/)


Operation-based auditing on files or folders

Operation-based auditing is a new feature in the Windows Server 2003 family. In earlier versions of Windows, information that was gained from object access auditing was not as detailed as it is with operation-based auditing. While you could determine that a user attempted to access an object, there was no way to be sure that the object was accessed in every way that was documented in the audit event. With operation-based auditing, you can audit operations on files and folders. This means that you can audit certain operations, such as Write, as well as the accessing of objects. Operation-based auditing is enabled when object access auditing is enabled on a file or folder. Object access events are recorded, along with operations such as Write, in the security log.

To enable operation-based auditing, you must:

  • Enable the Audit object access policy setting. For more information, see To define or modify auditing policy settings for an event category.
  • Apply audit policy to a specific folder. For more information, see:
    • To apply or modify auditing policy settings for a local file or folder
    • To apply or modify auditing policy settings for an object using Group Policy

Operation-based audits are categorized as object audits, and they are logged as event number 567 in the security log. They are generated the first time an operation is performed. Only files and folders can be set up to generate operation-based audits.


Auditing settings on objects

Each object has a set of security information, or security descriptor, attached to it. Part of the security descriptor specifies the groups or users that can access an object and the types of access (permissions) that are granted to those groups or users. This part of the security descriptor is known as a discretionary access control list (DACL).

A security descriptor for an object also contains auditing information. This auditing information is known as a system access control list (SACL). More specifically, a SACL specifies the following:

  • The group or user accounts to audit when they access the object.
  • The operations to be audited for each group or user, for example, modifying a file.
  • A Success or Failure attribute for each access event, based on the permissions that are granted to each group and user in the object's DACL.

You can apply auditing to an object, and, through inheritance, the auditing can apply to any child objects. For example, if you want to audit failed access to a folder, this auditing event can be inherited by all files within the folder. For more information, see How inheritance affects file and folder auditing.

To audit files and folders, you must be logged on as a member of the Administrators group.

For more information about auditing, see Auditing security events.


How inheritance affects file and folder auditing

After you set up auditing on a parent folder, new files and subfolders that are created in that folder inherit auditing. If you do not want them to inherit auditing, in the Apply onto box in the Auditing Entry for File or Folder dialog box, click This folder only when you set up auditing for the parent folder. In cases where you want to prevent only certain files or subfolders from inheriting auditing, right-click the file or subfolder that you want to prevent from inheriting auditing, click Properties, click the Security tab, click Advanced, click the Auditing tab, and then clear the check box that is labeled Inherit from parent the auditing entries that apply to child objects. Include these with entries explicitly defined here.

If the check boxes in Auditing Entry for File or Folder are unavailable or if, in Access Control Settings, the Remove button is unavailable, auditing has been inherited from the parent folder.

To make changes to inherited auditing:

  • Make the changes to the parent folder, and then the file or folder will inherit auditing.
  • On the Auditing tab in the Advanced Security Settings for File or Folder dialog box, clear the check box that is labeled Inherit from parent the auditing entries that apply to child objects. Include these with entries explicitly defined here. You can then click Edit or Remove to make changes or remove auditing. However, the file or folder will no longer inherit auditing changes from the parent folder.

For more information, see Auditing security events.


Selecting where to apply auditing entries

The Auditing Entry dialog box appears when you audit files or folders. In this dialog box, the Apply onto list displays the locations where you can apply auditing entries. How these auditing entries are applied depends on whether the Apply these auditing entries to objects and/or containers within this container only check box is selected. By default, this check box is cleared.

Click either Cleared or Selected below to see how auditing entries are applied, depending on whether this check box is cleared or selected. When this check box is:

Cleared …

Apply onto | Audits the current folder | Audits subfolders in the current folder | Audits files in the current folder | Audits all subsequent subfolders | Audits files in all subsequent subfolders
This folder only | x |  |  |  |
This folder, subfolders, and files | x | x | x | x | x
This folder and subfolders | x | x |  | x |
This folder and files | x |  | x |  | x
Subfolders and files only |  | x | x | x | x
Subfolders only |  | x |  | x |
Files only |  |  | x |  | x

Selected …

Apply onto | Audits the current folder | Audits subfolders in the current folder | Audits files in the current folder | Audits all subsequent subfolders | Audits files in all subsequent subfolders
This folder only | x |  |  |  |
This folder, subfolders, and files | x | x | x |  |
This folder and subfolders | x | x |  |  |
This folder and files | x |  | x |  |
Subfolders and files only |  | x | x |  |
Subfolders only |  | x |  |  |
Files only |  |  | x |  |

For information about how to set up auditing on objects, see Checklist: Setting up object access auditing.

For more information about auditing, see Auditing security events.


Per-user selective auditing

For information about per-user selective auditing, see "Security Auditing" at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/)

For information about auditing, see Auditing security events.


Auditing policies

Before you enable auditing, create audit policy. Audit policy pertains to specific categories of security-related events that you want to audit. By default, all auditing policy settings are not defined. On domain controllers, auditing is turned off by default. By turning on various auditing event categories, you can implement audit policy that suits the security needs of your organization.

The event categories that you can choose to audit are:

  • Audit account logon events
  • Audit account management
  • Audit directory service access
  • Audit logon events
  • Audit object access
  • Audit policy change
  • Audit privilege use
  • Audit process tracking
  • Audit system events

To audit objects on a domain controller, you must turn on the audit directory service access category. To audit objects on a member server or on a workstation, you must turn on the audit object access category. After you have turned on the object access category, you can specify what types of access you want to audit for each group or user. For more information on setting auditing on objects, see Audit settings on objects.

To enable auditing of local objects, you must be logged on as a member of the Administrators group.