Definitions Flashcards
Controls how the system audits object access attempts.
System Access Control List
Auditing - POPPSALAD
Network based access to computer and attempts to connect to shares; also known as authentication events.
Account Logon
Windows Architecture
Meet government and industry requirements for system security and protections against external tampering.
Security
Domain Controller Logs
_ _ logs = available when machine is configured as a DNS server.
DNS Server
Subsystem DLLs
Contains basic functions; such as windows management, user input, text, etc. Allows use of GUI.
user32.dll
HKLM Software
CurrentVersion\ _ = executes a program the next time a user logs on.
CurrentVersion\RunOnce
Auditing POPPSALAD
When an object (file, folder, etc) is accessed that has a SACL.
Object Access
SID
S-1-5-#s-__=
Administrator
User account
500
In a __, each system shares common configurations, resources, and security principles.
Domain
Windows Registry
2 master keys are:
HKEY_USERS (HKU)
&
HKEY_LOCAL_MACHINE
System Processes
The subsystem process. Subsystem DLLs run in the context of this process
csrss.exe
Auditing POPPSALAD
Changes to users rights, windows firewall, GPOs, audit or trust policies.
Policy Change
Data Types
Raw binary data; hardware component information stored as binary data.
REG_BINARY
HKLM Software
CurrentVersion\__ = List of executables that run on system startup.
CurrentVersion\RUN
Logs
__ log= contains events logged by system components.
1st party
System Log
In a __, each system is considered standalone with regards to authentication and system security principles.
Workgroup
Subsystem DLLs
Part of the windows Graphic Device Interface that enables programs and applications to use graphics and formatted text.
gdi32.dll
Logs
__ log= contains events logged by programs.
3rd party
Application Log