WINDOWS SERVER 2008 SECURITY AUDITING WINDOWS

WINDOWS SERVER 2008 SECURITY AUDITING WINDOWS

Microsoft recommends configuring only necessary audit subcategory settings using a command-line tool included in Windows ServerВ 2008 called AuditPol.exe. For this reason, enabling Audit policy settings by category will likely cause excessive audit logging that will quickly fill up your event logs. If you enable any of the audit category settings in Windows ServerВ 2008 that are present in the GPMC, this action also enables subcategory settings related to each category. Although the same method is possible with Windows ServerВ 2008, you cannot individually configure the new audit subcategories using the Group Policy Management Console (GPMC) because the subcategories are not exposed in the GPMC. In the past, you could easily configure any of the nine audit categories using Group Policy. Although not all subcategories apply to Windows ServerВ 2008вЂ“based computers, you can configure many of them to record specific events that provide valuable information. However, Windows ServerВ 2008 allows you to manage Audit policy in a more precise way by including 50 Audit policy subcategories. Windows ServerВ®В 2008 includes the same nine Audit policy categories that are present in earlier versions of Windows: The information in the following sections of this appendix is designed to help you decide what to monitor to facilitate the collection of relevant audit data for your organization. However, if you configure audit settings so that too many authorized activities generate events, the Security event log will fill up with too much data. If you do not configure audit settings, it will be difficult or impossible to determine what took place during a security incident. Then an administrator can create an Audit policy to meet the security needs of your organization.

The audit settings you choose within the event categories define your Audit policy. However, before you implement an Audit policy you must investigate which event categories to audit in your environment. For all of these reasons, Microsoft recommends that you form an Audit policy for an administrator to implement in your environment. Administrators can monitor security-related activity, such as who accesses an object, when users log on to or log off from computers, or if changes are made to an Audit policy setting.

Configuring and Testing Object Access Audit RulesДЄn Audit policy determines which security events to report to administrators to establish a record of user or system activity based on specified event categories.

Windows server 2008 security auditing