Windows security auditing — Event Log FAQ

 

Windows security auditing can be enabled using either Group Policy (in Active Directory environment) or Local Security Policy (for a single computer). Open Windows Control Panel, select Administrative Tools, and then run Local Security Policy. Open Local Policies branch and select Audit Policy. In the right pane of Local Security Policy window, you will see a list of audit policies. Double click on the required policy and choose what attempts (Success or Failure) to log.
Here we described setting up basic audit policies. Starting from Windows 2008 R2/Windows 7, you can use Advanced Security Audit Policy: Local Security Policy -> Advanced Audit Policy Configuration -> System Audit Policies.
More information about Advanced Security Audit Policy available at https://technet.microsoft.com/en-us/library/dn319056.aspx

 

Windows security auditing lets you audit user logons and invalid logon attempts to your system. Windows generate these events not only when a user physically logons the system, but even when accessing a shared resource from a remote computer. Auditing logon events help the administrator or investigator to review users’ activity and detect potential attacks.

To log logon events run Local Security Policy. Open Local Policies branch and select Audit Policy. Double click on “Audit logon events” and enable Success and Failure options. After that, all user logons and invalid logon attempts will be logged to security event log. 

 

Here are some important logon events

 

Event ID	Event message
4624	An account was successfully logged on
4625	An account failed to log on
4648	A logon was attempted using explicit credentials
4675	SIDs were filtered

 

Windows security auditing lets you audit access to an object, e.g. file, folder, registry key and other system objects that have system access control list (SACL). It is important task for a system administrator to organize file server auditing, but it may be reasonable to audit not only file servers. Auditing logon events help the administrator or investigator to review users’ activity, detect attempts of unauthorized access to files, and prevent software misconfiguration. 

To log file access events, run Local Security Policy. Open Local Policies branch and select Audit Policy. Double click on “Audit object access” and enable Success and Failure options. This enables system-wide object access audit. Now we should select file objects, which will trigger this event. Open Windows Explorer and brows for the required file or folder. Click right mouse button on this object and select Properties. Switch to Security tab and click Advanced button. Switch to Auditing tab in Advanced Security Settings window. Click Continue button. Now you can set the names of the users or groups whose access you want to audit (you can choose everyone for all users) and what type of access to the file will be audited. Starting from Windows 2008 R2/Windows 7, you can use more flexible object access/file access audit policy settings.

 

Here are some important file access events