Ensure No Auditing for 'Audit Policy: Object Access: Registry'
|ID: oval:org.secpod.oval:def:35476||Date: (C)2016-06-10 (M)2017-10-23|
|Class: COMPLIANCE||Family: windows|
This subcategory reports when registry objects are accessed. Only registry objects with SACLs cause audit events to be generated, and only when they are accessed in a manner matching their SACL. By itself, this policy setting will not cause auditing of any events. It determines whether to audit the event of a user who accesses a registry object that has a specified system access control list (SACL), effectively enabling auditing to take place.
A SACL is comprised of access control entries (ACEs). Each ACE contains three pieces of information:
- The security principal (user, computer, or group) to be audited.
- The specific access type to be audited, called an access mask.
- A flag to indicate whether to audit failed access events, successful access events, or both.
If you configure the Audit object access setting to Success, an audit entry is generated each time that a user successfully accesses an object with a specified SACL. If you configure this policy setting to Failure, an audit entry is generated each time that a user fails in an attempt to access an object with a specified SACL.
Organizations should define only the actions they want enabled when they configure SACLs. For example, you might want to enable the Write and Append Data auditing setting on executable files to track when they are changed or replaced, because computer viruses, worms, and Trojan horses typically target executable files. Similarly, you might want to track when sensitive documents are accessed or changed.
Events for this subcategory include:
- 4657 : A registry value was modified.
- 5039: A registry key was virtualized.
Refer to the Microsoft Knowledgebase article 'Description of security events in Windows Vista and in Windows Server 2008' for the most recent information about this setting: http://support.microsoft.com/kb/947226.
|Microsoft Windows 10|