> Resources > WinSecWiki

Windows Server 2008 and Vista introduce a totally new security log. All - and I mean ALL - the event IDs are different. There are now 57+ categories - most with their own audit policy. That's right we're going from 9 to 57 different audit policies that control what gets logged. The format of log data is different; it's now XML. And there are new features for pushing events from one computer to another and triggering scripts to run when specified events get logged.

I strongly recommend against enabling any of these entire categories; you will generate too much noise. I recommend starting with my Recommended Baseline Audit Policy for Windows Server 2008 and then tweaking from there.

For a list of all Security Log Events (several hundred), click here.

Edit

Security Log Categories

You can still configure the 9 top level audit policies using group policy under Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy but you can only configure the subcategories with the AuditPol command line utility.

• Account Logon
• Account Management
• Detailed Tracking
• DS Access
• Logon/Logoff
• Object Access
• Policy Change
• Privilege Use
• System

Other security log events

• Non Audit
• Uncategorized
  • Subcategory could not be determined

For an expanded list of categories and subcategories click here.