[Forgot Password]
Login  Register Subscribe

23631

 
 

115038

 
 

96174

 
 

909

 
 

78077

 
 

109

Paid content will be excluded from the download.


Download | Alert*
CCE
view XML

CCE-36322-6

Platform: win2012r2Date: (C)2015-10-08   (M)2017-09-27



Audit Policy: Logon-Logoff: Other Logon/Logoff Events This subcategory reports other logon/logoff-related events, such as Terminal Services session disconnects and reconnects, using RunAs to run processes under a different account, and locking and unlocking a workstation. Events for this subcategory include: ? 4649: A replay attack was detected. ? 4778: A session was reconnected to a Window Station. ? 4779: A session was disconnected from a Window Station. ? 4800: The workstation was locked. ? 4801: The workstation was unlocked. ? 4802: The screen saver was invoked. ? 4803: The screen saver was dismissed. ? 5378: The requested credentials delegation was disallowed by policy. ? 5632: A request was made to authenticate to a wireless network. ? 5633: A request was made to authenticate to a wired network. Refer to the Microsoft Knowledgebase article ?Description of security events in Windows Vista and in Windows Server 2008? for the most recent information about this setting: http://support.microsoft.com/default.aspx/kb/947226.


Parameter:


Technical Mechanism: (1) GPO: Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff!Audit Policy: Logon-Logoff: Other Logon/Logoff Events (2) WMI: ###

References:

Resource IdReference
SCAP Repo OVAL Definitionoval:org.secpod.oval:def:22890


OVAL    1
oval:org.secpod.oval:def:22890
XCCDF    6
xccdf_org.secpod_benchmark_NIST_800_53_r4_Windows_2012_R2
xccdf_org.secpod_benchmark_PCI_Windows_2012_R2
xccdf_org.secpod_benchmark_ISO27001_Windows_2012_R2
xccdf_org.secpod_benchmark_general_Windows_2012_R2
...

© 2013 SecPod Technologies