WinSecWiki > Security Settings > Advanced Audit Policies > System > System Integrity

Audit System Integrity

This category logs at least 3 events that could impact the over all integrity of the system. As will all subcategories you must use auditpol to enable or disable it.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event ID	Title
5038	Code integrity determined that the image hash of a file is not valid.
5056	A cryptographic self test was performed.
5061	Cryptographic operation.

Back to top

 

Upcoming Webinars Securing Every Identity in the Hybrid Era: Building a Unified Strategy Across Cloud, On-Prem, and AI “3 Persistent Privileged Access Methods in Active Directory: How Attackers Stick the Landing with AdminSdHolder, SIDHistory, DCShadow”

Additional Resources