Before configuring auditing you first need to understand the difference between two similarly named 1
policies settings audit account log on events and audit log on events when a user science into any computer 2
or the domain by using a domain user account edamame controller authenticates this attempt. 3
This generates an account log on a wound on the domain controller. 4
The computer to which the user assigned soon for example the user's laptop generates a log on a wound. 5
The computer did not authenticate the user against the account but rather passed the account to a domain 6
controller for validation. 7
However the computer did allow the user to sign in interactively to the computer. 8
Therefore the event is a log on a wound when a user connects to a folder on a server in the domain that 9
server also resides the user for a type of log on call to a network log on again the server does not 10
authenticate the user. 11
Instead it relies on the ticket that the domain controller gives to the user. 12
However the user connection generally generates a log on account on the server. 13
Now let's talk about advanced audit policies and basic audit policies. 14
In previous Windows Server versions such as Windows Server 2008. 15
There are only 9 auditing categories. 16
Administrators can configure each category to perform auditing and to monitor their success failure 17
or both success and failure of specific tasks and events. 18
These events are fairly broad in scope and can be triggered by a variety of similar actions some of 19
which can generate a large number of we went log entries in Windows Server 2012 found Windows Server 20
2016. 21
The number of auditable events expanded from nine to fifty three which enables administrators to be 22
more selective in the number and types of events to audit this new advanced audit policies allow administrators 23
to connect business rules sound audit policies. 24
This gives administrators much more control over their Logan process and they can obtain information 25
about very specific events that happened during the Logan and log of process for an account log on a. 26
You know can define for different audit sentence which are credential validation it audits events that 27
validation tests generate on user account log on credentials and other settings. 28
Gerber a service ticket operations it audits events that Cobra's service ticket requests generate. 29
Next one is other account log on arounds it audits events that are generated by responses to credential 30
requests that are not credential validation or Cobra's tickets or requests. 31
And the fourth one is Gerber as authentication service. 32
It audits events that occur birth authentication TGT requests generate. 33
Additionally you can audit the following log on and log off events. 34
You can audit log home. 35
These are the events that are generated by user account log on attempts on a computer log golf. 36
It audits events that close on a log on session generates these events secure on the accessed computer 37
and for an interactive log on the security audit event is generated on the computer to which the user 38
account logged on. 39
You can audit account lockout to end. 40
It is generated by a failed attempt to assign into an account that is locked out. 41
You can audit IP SEC main mode. 42
These are audit events that are generated by the Internet key exchange protocol or I key K E protocol 43
and authenticated Internet Protocol or oth IP. 44
During main negotiations you can audit IP SEC week mode. 45
This event that I see and also IP generate you're in Greek mode negotiations IP SEC extended mode. 46
These are audit events that IKB and also IP generate your an extended mode negotiations you can 47
more ordered special logo on it audits events that special log ons generate other log on and log off 48
events and network policies server it audits events that are generated by radius Internet authentication 49
service and map user access requests this request can be ground deny discard quarantine log count unlock 50
now some words about basic audit policies versus advanced audit policies the basic security audit policies 51
settings are in security settings local policies audit policy and the advanced security audit policies 52
settings are in security settings advanced audit policy configuration and audit policies although the 53
base account advance security audit all these incidents appear to overlap they are recorded and applied 54
differently than new set of advanced audit policies enables administrators to be more selective in their 55
number and types of events to audit for example where a basic audit policy provides a single Saddam 56
for loop account log gone advanced audit policy provides for enabling the single basic account to log 57
on certain is the equivalent of certain all for advanced account log on Saddam's in comparison said 58
in a single advanced order and policies certain does not generate audit events for activities for which 59
you have no interest. 60
For example if you enable success audit to enforce the basic audit account log on Iran's policies certain 61
only success events will be logged for role account log on related behaviors in comparison you can configure 62
a success audit and for one advanced account log on certain failure audit in for a second. 63
Advanced account log on certain success and failure audit and for a thought advanced account log on 64
certain and no audit and dependent on the needs of your organization. 65
Please note that using both the base entered one sentence can cause unexpected results. 66
Therefore do not combine the two sets of audit policies Saddam's if you use advanced audit policy configuration 67
settings you should enable the audit force audit policies subcategory sadness to override audit policy 68
categories settings it's a policy asset and under local policies security options. 69
This will prevent conflicts between similar assertions by force in basic security order an audit and 70
to be ignored. 71
Now some reports about scoping audit policies. 72
As with all policy assertions you should define the scope carefully for the GOP rules that apply your 73
audit policies so that the surgeons affect the correct systems. 74
For example if you want to audit attempts by users to connect to remote desktop servers in your enterprise 75
you can configure log on events auditing in a GPO that is linked to the O you that contains your remote 76
desktop servers. 77
However on the other hand if you want to audit desktop lagoons by users in your human resource department 78
you can configure log on a wound to auditing in a GPO that is linked to the O you that contains human 79
resources computer objects. 80
Remember that domain user who signs into a client computer or connects to a server will generate a log 81
on a wound not an account log on a wound on that system. 82
Only domain controllers generate account log on events for domain users. 83
Remember that an account log on a worm track eurozone the domain controller of that authenticates a 84
the main user regardless of where that user logs on. 85
If you want to audit log on to domain accounts you should ensure account log on around auditing to affect 86
all domain controllers. 87
The default domain controller GPO that is created when you install your first domain controller is an 88
ideal GPO in which to configure account log on audit policies. 89
Next up we'll see how to configure authentication related audit policies and will you log on Iran's.