l Identify the “out-of-the-box” audit settings l Identify recommended minimum audit settings l Configure security event log settings to meet recommendations l Use the event log to detect security problems Module 8 Overview:

l Audit Policy l Auditing l Audit Logs General Auditing Information

Auditing System Event Security Event Application Event Event Log Service Event Logs Event Viewer FILES:: APPEVENT.EVT SYSEVENT.EVT SECEVENT.EVT

l Default Settings l What Should Be Set? Logins/Logoffs Security Policy Changes File and Object Auditing Auditing

l Auditing Policy Changes l Audit Categories Auditing

Auditing

Auditing

l Event Filtering By l Success l Failure l Source l Primary ID l Client ID Auditing

l Information Windows NT tracks within a process access token. (Also used for auditing) l The security ID of the user account used to log on l The group security IDs and corresponding attributes of groups to which the user is assigned membership l The names of the privileges assigned to and used by the user, and their corresponding attributes l Authentication ID, assigned when the user logs on Auditing

Auditing

Auditing

l Settings For Auditing Settings For Event Log Reading And Backing Up The Event Log Auditing

l Auditing