WinSecWiki

WinSecWiki » Windows Security Settings » Local Policies » Security Options » Audit: Audit the use of global system objects

Audit: Audit the use of global system objects

Expand / Collapse
 
     

Audit: Audit the use of global system objects


Enabling, this policy has no effect unless Audit object access events is also enabled.

Enabling this policy causes Windows to create internal system objects with a default system access control list (SACL) that specifies operations on such objects to be reported to the security log. The internal system objects include mutexes, semaphores and other objects that really only have meaning to programmers. This feature was only added to Windows to get Common Criteria evaluation; it has no real value and only creates useless noise in the security log. Leave it disabled.

If this policy is enabled, it causes system objects, such as mutexes (mutual exclusive), events, semaphores (locking mechanisms used inside resource managers or resource dispensers), and DOS devices, to be created with a default system access control list (SACL).

Related event IDs: 560/4656.

Add Your Comments


Name: *
Email Address:
Web Address:
Verification Code:
*
 

Details
Article not rated yet.
Article has been viewed 1,119 times.
Options