1. l Identify the “out-of-the-box” audit settings l Identify recommended minimum audit settings l Configure security event log settings to meet recommendations l Use the event log to detect security problems Module 8 Overview:

2. l Audit Policy l Auditing l Audit Logs General Auditing Information

3. Auditing System Event Security Event Application Event Event Log Service Event Logs Event Viewer FILES:: APPEVENT.EVT SYSEVENT.EVT SECEVENT.EVT

4. l Default Settings l What Should Be Set? Logins/Logoffs Security Policy Changes File and Object Auditing Auditing

5. l Auditing Policy Changes l Audit Categories Auditing

6. Auditing

7. Auditing

8. l Event Filtering By l Success l Failure l Source l Primary ID l Client ID Auditing

9. l Information Windows NT tracks within a process access token. (Also used for auditing) l The security ID of the user account used to log on l The group security IDs and corresponding attributes of groups to which the user is assigned membership l The names of the privileges assigned to and used by the user, and their corresponding attributes l Authentication ID, assigned when the user logs on Auditing

10. Auditing

11. Auditing

12. l Settings For Auditing Settings For Event Log Reading And Backing Up The Event Log Auditing

13. l Auditing