WinSecWiki > Security Settings > Advanced Audit Policies

Windows Advanced Audit Policy Settings

This group is new as of Server 2008 R2 which you can find in "Advanced Audit Policy Configuration". Under that you will find “System Audit Policies – Local Group Policy Object”. From this point you can use group policies to configure the settings.If configured it can override Local Policy audit settings.

User Account Management Sub-Category

This Sub-Category can be set by Group Policy with Windows Server 2008 R2 or later.

See events in this group

Computer Account Management Sub-Category

This Sub-Category can be set by Group Policy with Windows Server 2008 R2 or later. It records events having to do with computer accounts in Active Directory.

Events produced by by this setting

Security Group Management Sub-Category

This Sub-Category can be set by Group Policy with Windows Server 2008 R2 or later. It records events having to do with security groups in Active Directory and on the local computer.

Events produced by by this setting

Distribution Group Management Sub-Category

This Sub-Category can be set by Group Policy with Windows Server 2008 R2 or later.

See events in this group

Child articles:

• Account Logon
• Account Management
• Detailed Tracking
• DS Access
• Logon/Logoff
• Object Access
• Policy Change
• Privilege Use
• System
• Global Object Access Auditing

Back to top

 

Upcoming Webinars Assessing the Security of Your Active Directory: User Accounts Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources