[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244411

 
 

909

 
 

193363

 
 

277

Paid content will be excluded from the download.


Download | Alert*
OVAL

Audit Policy: Policy Change: Audit Policy Change

ID: oval:org.secpod.oval:def:22989Date: (C)2015-01-07   (M)2023-07-31
Class: COMPLIANCEFamily: windows




This subcategory reports changes in audit policy including SACL changes. Events for this subcategory include: ? 4715: The audit policy (SACL) on an object was changed. ? 4719: System audit policy was changed. ? 4902: The Per-user audit policy table was created. ? 4904: An attempt was made to register a security event source. ? 4905: An attempt was made to unregister a security event source. ? 4906: The CrashOnAuditFail value has changed. ? 4907: Auditing settings on object were changed. ? 4908: Special Groups Logon table modified. ? 4912: Per User Audit Policy was changed. Refer to the Microsoft Knowledgebase article ?Description of security events in Windows Vista and in Windows Server 2008? for the most recent information about this setting: http://support.microsoft.com/default.aspx/kb/947226. Fix: (1) GPO: Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Policy Change!Audit Policy: Policy Change: Audit Policy Change (2) REG: NO REGISTRY INFO

Platform:
Microsoft Windows Server 2012 R2
Reference:
CCE-38028-7
CPE    1
cpe:/o:microsoft:windows_server_2012::r2:x64
CCE    1
CCE-38028-7
XCCDF    1
xccdf_org.secpod_benchmark_general_Windows_2012_R2

© SecPod Technologies