Tools · Windows security and Event Logs · 13 / 27
Windows advanced audit policy: what to enable with auditpol and Group Policy
Check the effective audit policy with auditpol, enable the subcategories that produce useful security events, and avoid the legacy-policy conflict.
No audit, no event
Most of the Security log events defenders rely on only appear if the matching audit subcategory is enabled. Windows defaults log some logon events but leave many useful categories off. Advanced Audit Policy Configuration has 50-plus subcategories under ten categories, each with success and failure settings.
auditpol /get /category:* shows the effective settings on a machine, which is the only reliable view, because Group Policy, local policy, and legacy settings can interact.
auditpol /get /category:* auditpol /get /subcategory:"Logon","Process Creation","Security Group Management"
A practical baseline
Enable success and failure for Credential Validation, Logon, Logoff (success), Account Lockout (failure), Special Logon (success), User Account Management, Security Group Management, Process Creation (success), Audit Policy Change, Authentication Policy Change, Security System Extension, Other Object Access Events, and Sensitive Privilege Use on servers where volume allows. On domain controllers add Kerberos Authentication Service, Kerberos Service Ticket Operations, and Directory Service Changes.
Microsoft’s and CIS’s recommended baselines are similar. Start there and tune by volume.
Lab: apply and verify
Apply the baseline on a lab VM with auditpol, then confirm with auditpol /get. For domains, set it in a GPO under Computer Configuration, Policies, Windows Settings, Security Settings, Advanced Audit Policy Configuration, and enable “Force audit policy subcategory settings to override audit policy category settings” so legacy category settings do not overwrite it.
Run gpresult /h report.html on a member machine to confirm the GPO applied.
auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable auditpol /set /subcategory:"Logon" /success:enable /failure:enable auditpol /set /subcategory:"Security Group Management" /success:enable auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable auditpol /set /subcategory:"Process Creation" /success:enable auditpol /set /subcategory:"Audit Policy Change" /success:enable auditpol /backup /file:C:\audit-baseline.csv
Watch for policy tampering
Event 4719 “System audit policy was changed” records when someone alters the audit policy, which attackers sometimes do to stop logging. Alert on it centrally.
Back up the effective policy with auditpol /backup and compare it periodically. Drift often comes from a forgotten local policy on a server.
Diagram
Subcategories and the events they unlock
Enable the subcategory, get the event.
- Logon
4624, 4625, 4634.
- User Account Management
4720, 4722, 4724, 4726, 4738.
- Security Group Management
4728, 4732, 4756.
- Process Creation
4688.
- Other Object Access Events
4698 to 4702 scheduled tasks.
- Audit Policy Change
4719.
Check yourself
1. Which command shows the effective audit policy on a machine?
2. Why enable “Force audit policy subcategory settings to override”?
3. Which event shows that someone changed the audit policy?