Auditing security events

You can set up auditing to detect and record security-related events, such as when a user attempts to access a confidential file or folder. When you audit an object, an entry is written to the Windows XP Professional security log whenever the object is accessed in a certain way. You determine which objects to audit, whose actions to audit, and exactly what types of actions are audited. Once you set up auditing, you can keep track of users who access certain objects and analyze security breaches. The audit trail, which logs the events you have chosen, can show who performed the actions and who tried to perform actions that are not permitted.

  • For tips about auditing, see Best practices for auditing.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.


Best practices

Microsoft Windows graphic

Best practices for auditing

To minimize the risk of security threats, there are a number of auditing steps you can take. The following table lists various events that you should audit, as well as the specific security threat that the audit event monitors.

Audit Event | Potential Threat
Failure audit for logon/logoff | Random password hack
Success audit for logon/logoff | Stolen password break-in
Success audit for privilege use, user and group management, security change policies, restart, shutdown, and system eventss | Misuse of privileges
Success and failure audit for file-access and object-access events. File Manager success and failure audit of Read/Write access by suspect users or groups for the sensitive files. | Improper access to sensitive files
Success and failure audit for file-access printers and object-access events. Print Manager success and failure audit of print access by suspect users or groups for the printers. | Improper access to printers
Success and failure write access auditing for program files (with .exe and .dll extensions). Success and failure auditing for process tracking. Run suspect programs; examine security log for unexpected attempts to modify program files or create unexpected processes. Run only when actively monitoring the system log. | Virus outbreak

For more information, see Audit policy.

Related Topics


How to...

  • Establish an auditing policy
  • Enable Audit Object Access policy
  • Set, view, change, or remove auditing for a file or folder
  • View the security log


Establish an audit policy

Microsoft Windows graphic

To establish an audit policy

  1. Perform one of these steps:
    If | Do this
    You want to modify security settings for your local computer | Open Local Security Settings.
    You are on a workstation or server, which is joined to a domain, and you would like to modify security settings for a Group Policy object.
    • Click Start, point to Run, type mmc and click OK.
    • In the console, click the File menu and click Add/Remove snap-in.
    • In Add/Remove Snap-in, click Add. In Add Standalone Snap-in, double-click Group Policy.
    • In Select Group Policy Object, click Browse, browse to the policy object you would like to modify, and click Finish.
    • Click Close and then click OK.
  2. In the console tree, click Audit Policy.

    Where?

    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Local Policies
    • Audit Policy
  3. In the details pane, double-click an audit policy for which you would like to change audit settings and select the Define these policy settings check box.
  4. Do one or both of the following:
    • To audit successful attempts, select the Success check box.
    • To audit unsuccessful attempts, select the Failure check box.
  5. Repeat the last two steps for any additional audit policies you would like to change.

Note

  • XOX
  • XOX

For more information, see Audit policy.


How to enable Audit Object Access

Microsoft Windows graphic

To enable the Audit Object Access policy

  1. Choose one of the following
    2. If | Do this
    You want to modify security settings for your local computer | Open Local Security Settings.
    You are on a workstation or server, which is joined to a domain, and you would like to modify security settings for a Group Policy object.
    • Click Start, point to Run, type mmc and click OK.
    • In the console, click the File menu and click Add/Remove snap-in.
    • In Add/Remove Snap-in, click Add. In Add Standalone Snap-in, double-click Group Policy.
    • In Select Group Policy Object, click Browse, browse to the policy object you would like to modify, and click Finish.
    • Click Close and then click OK.
  2. In the console tree, double-click Audit Policy.

    Where?

    • Object Policy
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Local Policies
    • Audit Policy
  3. Double-click Audit Object Access, and in Audit object access Properties, select the Define these policy settings check box.
  4. Do one or both of the following:
    • To audit successful attempts, select the Success check box.
    • To audit unsuccessful attempts, select the Failure check box.

Notes

  • XOX
  • XOX
  • Setting changes are applied every 90 minutes on a workstation or server and every five minutes on a Domain Controller. Every 16 hours there is a forced refresh on the settings regardless of any changes

For more information, see Audit object access.

Related Topics


Set, view, change, or remove auditing for a file or folder

Microsoft Windows graphic

To set, view, change, or remove auditing for a file or folder

  1. Open Windows Explorer, and then locate the file or folder you want to audit.
  2. Right-click the file or folder, click Properties, and then click the Security tab.
  3. Click Advanced, and then click the Auditing tab.
  4. Do one of the following:
    • To set up auditing for a new user or group, click Add. In Name, type the name of the user or group you want, and then click OK.
    • To view or change auditing for an existing group or user, click the name, and then click Edit.
    • To remove auditing for an existing group or user, click the name, click Remove, click OK, and then skip the rest of this procedure.
  5. If you are setting auditing for a folder, in Auditing Entry for File or Folder, in Apply onto, select where you want auditing to take place.
  6. In the Access box, do any of the following for each event you want to specify:
    • To audit successful events, select the Successful check box.
    • To stop auditing successful events, clear the Successful check box.
    • To audit unsuccessful events, select the Failed check box.
    • To stop auditing unsuccessful events, clear the Failed check box.
    • To stop auditing all events, click Clear All.
  7. If you want to prevent files and subfolders within the tree from inheriting these audit entries, select the Apply these auditing entries to objects and/or containers within this container only check box.

Important

  • Before setting up auditing to files and folders, you or your domain administrator must enable the Audit Object Access setting located in Audit Policy. If you do not, you receive an error message when you set up auditing for files and folders, and no files or folders will be audited. For more information, see Enable Audit Object Access policy.

Notes

  • To audit files and folders, you must be logged on as a member of the Administrators group or have been granted the Manage auditing and security log right in Group Policy.
  • XOX
  • If you are not joined to a domain and want to view the Security tab, see To display the Security tab.
  • Once object access auditing is enabled, view the security log in Event Viewer to review the results of your changes.
  • You can set file and folder auditing only on NTFS drives.
  • You may see one of these circumstances:
    • In Auditing Entry for File or Folder, in the Access box, the check boxes are shaded.
    • In the Advanced Security Settings for File or Folder, the Remove button is unavailable.
    In these cases, auditing has been inherited from the parent folder.
  • Because the security log is limited in size, you should select the files and folders to be audited carefully. You should also consider the amount of disk space you are willing to devote to the security log. The maximum size is defined in Event Viewer.

Related Topics


View the security log

Microsoft Windows graphic

To view the security log

  1. Open Computer Management.
  2. In the console tree, click Event Viewer.

    Where?

    • System Tools
    • Event Viewer
  3. In the details pane, double-click Security.
  4. To see further information on an event, in the details pane, double-click the event.

For more information about security events, see Security Events on the Microsoft Windows Resource Kits Web site (http://www.microsoft.com/).

Notes

  • XOX
  • XOX


Concepts

  • Auditing policies
  • Viewing security logs
  • Operation-based auditing on files and folders
  • Audit settings on objects
  • How inheritance affects file and folder auditing
  • Selecting where to apply auditing entries


Auditing policies

Before you implement auditing, you must decide on an auditing policy. An auditing policy specifies categories of security-related events that you want to audit. When Windows XP Professional is first installed, all auditing categories are turned off. By turning on various auditing event categories, you can implement an auditing policy, one that suits the security needs of your organization.

The event categories that you can choose to audit are:

  • Audit account logon events
  • Audit account management
  • Audit directory service access
  • Audit logon events
  • Audit object access
  • Audit policy change
  • Audit privilege use
  • Audit process tracking
  • Audit system events

If you choose to audit access to objects as part of your audit policy, you must turn on either the audit directory service access category (for auditing objects on a domain controller), or the audit object access category (for auditing objects on a member server or workstation). Once you have turned on the object access category, you can specify what types of access you would like to audit for each group or user. For more information on setting auditing on objects, see Audit settings on objects.

To enable auditing of local objects, you must be logged on as a member of the Administrators group.


Viewing security logs

Auditing a local object creates an entry in the security log. The security entries that appear in the security log depend on the auditing categories selected for your auditing policy. For events concerning access to objects, the entries in the security log also depend on the audit settings defined for each object.

For example, if your auditing policy specifies auditing of files and folders, and a file's properties specify that failed deletions of that file are to be audited, then each failed attempt by a user to delete the file will appear in the security log.

You can view the security log using Event Viewer.

Size of the security log

It is important that you set the size of the security log appropriately. Because the security log is limited in size, you should select the categories of events to be audited carefully. You should also consider the amount of disk space you are willing to devote to the security log. The maximum size is defined in Event Viewer.

For information on what to do when the security log is full, see Halting the computer when the security log is full.

For more information about security events, see Security Events (http://www.microsoft.com/) on the Microsoft Windows Resource Kits Web site.


Operation-based auditing on files or folders

Operation-based auditing allows you to audit operations on files and folders. This means you can set up auditing to generate audits for operations, such as read and write, as well as object access auditing. For example, if you have enabled auditing for writing to a file, writing to the file would generate an operation audit.

In order to enable operation-based auditing, you must:

  1. Enable the Audit Access Object policy.

    For more information, see Enable Audit Object Access policy.

  2. Set, view, change, or remove auditing for a file or folder

Operation audits are categorized as object audits and are flagged as event number 567. They are generated the first time an operation is performed. Only files and folders can be set up to generate operation audits.


Audit settings on objects

Each object has a set of security information, or security descriptor, attached to it. Part of the security descriptor specifies the groups or users that can access an object, and the types of access (permissions) granted to those groups or users. This part of the security descriptor is known as a discretionary access control list (DACL).

In addition to containing permissions information, however, a security descriptor for an object also contains auditing information. This auditing information is known as a system access control list (SACL). More specifically, a SACL specifies the following:

  • The group or user accounts to audit when accessing the object.
  • The access events to be audited for each group or user. An example of an access event is modifying a file.
  • A Success or Failure attribute for each access event, based on the permissions granted to each group and user in the object's DACL

In general, the types of access that can be audited depend on whether you are auditing access to files and folders or to Active Directory objects. The types of access are listed in the following sections.

You can apply auditing to an object and, through inheritance, the auditing can apply to any child objects. For example, if you want to audit failed write access to a folder, this auditing event can be inherited by all files within the folder. For more information, see How inheritance affects file and folder auditing.

Note

  • To audit files and folders, you must be logged on as a member of the Administrators group.

Related Topics


How inheritance affects file and folder auditing

After you set up auditing on a parent folder, new files and subfolders created in the folder inherit auditing. If you do not want them to inherit auditing, in Auditing Entry for File or Folder Name, in Apply onto, select This folder only when you set up auditing for the parent folder. In cases where you want to prevent only certain files or subfolders from inheriting auditing, right-click the file or subfolder that you want to prevent from inheriting auditing, click Properties, click the Security tab, click Advanced, click the Auditing tab, and then clear the Inherit from parent the auditing entries that apply to child objects. Include these with entries explicitly defined here. check box.

If the check boxes in Auditing Entry for File or Folder Name are shaded or if, in the Access Control Settings, the Remove button is unavailable, then auditing has been inherited from the parent folder. The ways to make changes to inherited auditing are:

  • Make the changes to the parent folder, and then the file or folder will inherit auditing.
  • On the Auditing tab, clear the Inherit from parent the auditing entries that apply to child objects. Include these with entries explicitly defined here. check box. Now you can click Edit or Remove to make changes or remove auditing. However, the file or folder will no longer inherit auditing changes from the parent folder.

Related Topics


Selecting where to apply auditing entries

The Auditing Entry dialog box appears when you audit files and folders. In this dialog box, the Apply onto list displays the locations where you can apply auditing entries. How these auditing entries are applied depends on whether Apply these auditing entries to objects and/or containers within this container only is selected. By default, this check box is cleared.

When the Apply these auditing entries so objects and/or containers within this container only check box is cleared

Apply onto | Audits current folder | Audits subfolders in the current folder | Audits files in the current folder | Audits all subsequent subfolders | Audits files in all subsequent subfolders
This folder only | x |  |  |  |
This folder, subfolders and files | x | x | x | x | x
This folder and subfolders | x | x |  | x |
This folder and files | x |  | x |  | x
Subfolders and files only |  | x | x | x | x
Subfolders only |  | x |  | x |
Files only |  |  | x |  | x

When the Apply these auditing entries so objects and/or containers within this container only check box is selected

Apply onto | Audits current folder | Audits subfolders in the current folder | Audits files in the current folder | Audits all subsequent subfolders | Audits files in all subsequent subfolders
This folder only | x |  |  |  |
This folder, subfolders and files | x | x | x |  |
This folder and subfolders | x | x |  |  |
This folder and files | x |  | x |  |
Subfolders and files only |  | x | x |  |
Subfolders only |  | x |  |  |
Files only |  |  | x |  |

Related Topics


Auditing concepts

Microsoft Windows Graphic

Concepts

This section provides general background information about auditing:

  • Auditing overview
  • Using auditing


Auditing security events overview

Establishing an audit trail is an important facet of security. Monitoring the creation or modification of objects gives you a way to track potential security problems, helps assure user accountability, and provides evidence in the event of a security breach.

There are three main steps to implementing security-related auditing for your system.

First, you must turn on the categories of events you want to audit. Examples of event categories are user logon and logoff and account management. The categories of events you select constitute your audit policy. When you first install Windows XP Professional, no categories are selected, and therefore no audit policy is in force. Computer Management lists the event categories that you can audit.

Second, you must set the size and behavior of the security log.

Finally, if you have selected either the audit directory service access category or the audit object access category, you must determine the objects to which you want to monitor access and modify their security descriptors accordingly. For example, if you want to audit any attempts by users to open a particular file, you can set a Success or Failure attribute directly on that file for that particular event.

For more information, see Audit policy.

Related Topics


Auditing

Security auditing monitors various security-related events. Monitoring system events is necessary to detect intruders and to detect attempts to compromise data on the system. An example of an event that can be audited is a failed logon attempt.

The most common types of events to be audited are:

  • Access to objects, such as files and folders
  • Management of user and group accounts
  • When users log on to and log off of the system

In addition to auditing security-related events, a security log is generated which provides a way for you view the security events reported in the log. You can view the security log with Event Viewer.

For more information, see Audit policy.

Related Topics


Setting up auditing

Object Access auditing

You can set up auditing on objects such as folders, printers, or registry keys. For more information, see Checklist: Auditing access to objects.

Event auditing

You can set up auditing policies to computerwide events. For more information, see Auditing policies and Establish an audit policy.

Related Topics


Auditing access to objects

Microsoft Windows graphic

Checklist: Auditing access to objects

Step | Reference
Review the Audit Access Object policy | Audit Access Object
Enable the Audit Access Object policy. | Enable Audit Object Access policy
Review audit settings | Audit settings on objects
Set up auditing on the file or folder. | Set, view, change, or remove auditing for a file or folder