1 Chapter Overview Planning an Audit Policy Implementing an Audit Policy Using Event Viewer

2 Auditing Auditing is a network security tool that lets you track User activities Microsoft Windows XP Professional events Windows XP Professional can record events in the security log. Valid and invalid logon attempts Events related to creating, opening, or deleting files or other objects

3 Using an Audit Policy An audit policy defines the types of events recorded in the security log. Windows XP Professional writes events to the security log on the computer where the event occurs. You can set up an audit policy for a computer to Track the success and failure of events Minimize the risk of unauthorized use of resources

4 Determining What to Audit Determine which computers need auditing. Auditing is turned off by default. Plan what to audit on each computer.

5 Selecting Events to Audit Accessing files and folders Logging on and off Shutting down and restarting a computer Changing user accounts and groups Attempting to make changes to objects in the Active Directory service

6 Auditing Successful Events and Failed Events Tracking successful events Tells you how often Windows XP Professional or users access objects Helps you plan resources Tracking failed events Alerts you to security breaches Identifies frequent failed logon attempts

7 Auditing Policy Guidelines Determine if you need to track system usage trends. Review security logs frequently. Define a useful, meaningful, and manageable audit policy.

8 Configuring Auditing Auditing requirements You must have the Manage Auditing And Security Log user right. The files and folders to be audited must be on NT file system (NTFS) volumes. Setting up auditing is a two-part process. Set the audit policy. Enable auditing of specific resources.

9 Setting an Audit Policy

10 Auditing Access to Files and Folders If security breaches are an issue, set up auditing for files and folders on an NTFS volume. Set up your audit policy to audit object access, and then Enable auditing for specific files and folders Specify which types of access to audit

11 Events That Can Be Audited for Files and Folders

12 Auditing Access to Printers Audit access to printers to track access to sensitive printers. Set your audit policy to audit object access. Enable auditing for specific printers. Specify the type of access to audit. Specify which users will have access.

13 Printer Events That Can Be Audited

14 Understanding Windows XP Professional Logs Use Event Viewer to view Windows XP Professional logs. By default, Event Viewer contains three logs: Application log Security log System log

15 Viewing Security Logs Type column: shows successful events (with a key icon) and unsuccessful events (with a lock icon) Date column: shows the date the event occurred Time column: shows the time the event occurred Source column: shows the software that recorded the event (it can be an application or a component of the system) Category column: shows the type of event, such as object access, account management, directory service access, or logon events Event column: shows the EventID User column: lists the user who succeeded or failed in the security access attempt Computer column: shows the computer the event occurred on

16 Locating Events

17 Managing Logs You can control the maximum size of the logs. The default size is 512 KB. The maximum size is 64 KB to 4 GB. You can specify what to do when a log is full. Overwrite events as needed. Overwrite events older than x days. Do not overwrite events.

18 Archiving Logs Keep logs for a specified period to track security-related information over time. Configure logs in Event Viewer. Archive the log. Clear the log. View an archived log.

19 Chapter Summary Auditing helps ensure that your network is secure by tracking user activities and system-wide events. Windows XP Professional records audited events in the security log. In planning an audit policy, you must decide on which computers to set up auditing and what to audit on each one. After you set your audit policy to audit object access, you can enable auditing for specific files, folders, and printers and specify which types of access to audit.

20 Chapter Summary (Cont.) You must have the Manage Auditing And Security Log user right for the computer on which you want to configure an audit policy or review an audit log. You use the Group Policy snap-in to set audit policies. You use Event Viewer to view the contents of the Windows XP Professional logs. Windows XP Professional has the following three logs by default: the application log, the security log, and the system log.

21 Chapter Summary (Cont.) You use the Filter and Find commands in Event Viewer to easily locate specific events or types of events. You view the security log on a remote computer by opening the MMC console and pointing Event Viewer to the remote computer. You manage the Windows XP Professional logs by archiving them (to allow you to track trends over time) and by controlling the size of the log files.