Windows Security Log Event ID 807

807: Per user auditing policy set for user

On this page

• Description of this event
• Field level details
• Examples
• Mini-seminars on this event

Not confirmed. See event 806 for more information on per user selective auditing.

See Roger Grimes article at www.windowsitpro.com for an excellent introduction to per user selective auditing

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 807

• Target user: %1
• Policy ID: %2
• Category Settings:
• System: %3
• Logon: %4
• Object Access %5
• Privilege Use: %6
• Detailed Tracking: %7
• Policy Change: %8
• Account Management: %9
• DS Access: %10
• Account Logon: %11

Supercharger Free Edition

 

 

Upcoming Webinars Assessing the Security of Your Active Directory: User Accounts Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy