WinSecWiki > Security Settings > Local Policies > Security Options > Audit > Audit the use of global system objects
Audit: Audit the use of global system objects
Enabling, this policy has no effect unless Audit object access events is also enabled.
Enabling this policy causes Windows to create internal system objects with a default system access control list (SACL) that specifies operations on such objects to be reported to the security log. The internal system objects include mutexes, semaphores and other objects that really only have meaning to programmers. This feature was only added to Windows to get Common Criteria evaluation; it has no real value and only creates useless noise in the security log. Leave it disabled.
If this policy is enabled, it causes system objects, such as mutexes (mutual exclusive), events, semaphores (locking mechanisms used inside resource managers or resource dispensers), and DOS devices, to be created with a default system access control list (SACL).
Related event IDs: 560/4656.
Back to top