[Forgot Password]
Login  Register Subscribe

23631

 
 

115083

 
 

97389

 
 

909

 
 

78730

 
 

109

Paid content will be excluded from the download.


Download | Alert*
CCE
view XML

CCE-37026-2

Platform: win2012r2Date: (C)2015-10-08   (M)2017-10-31



Audit Policy: Object Access: File Share This subcategory reports when a file share is accessed. By itself, this policy setting will not cause auditing of any events. It determines whether to audit the event of a user who accesses a file share object that has a specified system access control list (SACL), effectively enabling auditing to take place. A SACL is comprised of access control entries (ACEs). Each ACE contains three pieces of information: - The security principal (user, computer, or group) to be audited. - The specific access type to be audited, called an access mask. - A flag to indicate whether to audit failed access events, successful access events, or both. If you configure the Audit object access setting to Success, an audit entry is generated each time that a user successfully accesses an object with a specified SACL. If you configure this policy setting to Failure, an audit entry is generated each time that a user fails in an attempt to access an object with a specified SACL. Organizations should define only the actions they want enabled when they configure SACLs. For example, you might want to enable the Write and Append Data auditing setting on executable files to track when they are changed or replaced, because computer viruses, worms, and Trojan horses typically target executable files. Similarly, you might want to track when sensitive documents are accessed or changed. Events for this subcategory include: ? 5140: A network share object was accessed. Refer to the Microsoft Knowledgebase article ?Description of security events in Windows Vista and in Windows Server 2008? for the most recent information about this setting: http://support.microsoft.com/default.aspx/kb/947226.


Parameter:


Technical Mechanism: (1) GPO: Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access!Audit Policy: Object Access: File Share (2) WMI: ###

References:

Resource IdReference
SCAP Repo OVAL Definitionoval:org.secpod.oval:def:22827


OVAL    1
oval:org.secpod.oval:def:22827
XCCDF    6
xccdf_org.secpod_benchmark_NIST_800_53_r4_Windows_2012_R2
xccdf_org.secpod_benchmark_PCI_Windows_2012_R2
xccdf_org.secpod_benchmark_PCI_3_2_Windows_Server_2012_R2
xccdf_org.secpod_benchmark_ISO27001_Windows_2012_R2
...

© 2013 SecPod Technologies