WinSecWiki > Security Settings > Local Policies > Audit Policy > Policy Change

Audit Policy Change

The Audit policy change policy provides notification of changes to important security policies on the local system, such as changes to the system’s audit policy or, when the local system is a DC, changes to trust relationships. 

The following is an exerpt from my book, The Windows Security Log Revealed : 

The Policy Change category provides notification of changes to important security policies on the local system, such as to the system’s audit policy or, in the case of DCs, to trust relationships. 

For a list of Event IDs generated by this category, see the Security Log Encyclopedia. 

Bottom Line

• Windows XP, 2000 and 2003: I recommend enabling this policy for success on all computers including workstations. We have not observed any failure events in this category.
• Windows Server 2008 and Vista: I don't recommend managing audit policy at this level because too much noise is generated. Use subcategories instead. See Audit Category: Policy Change (Windows Server 2008 and Vista).

Child articles:

• Audit Policy Change
• Authentication Policy Change
• Authorization Policy Change
• MPSSVC Rule-Level Policy Change
• Filtering Platform Policy Change
• Other Policy Change Events

Back to top

 

Upcoming Webinars Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources