Server Admin I Unit 8.4 Audit Policy

Question 1

auditing

Answer 1

Recording of system events and other system changes which are enabled by audit policies

Question 2

Account Logon Audit Policy(2)

Answer 2

Tracks when a user account authenticates to a computer.

Local user accounts are recorded on local computer and domain user accounts are recorded on domain controller

Question 3

Event Log Subscription

Answer 3

Allows for centralizing of event logs from multiple computers.

Question 4

Account Management Audit Policy

Answer 4

Tracks changes to user accounts including create, rename, disable/enable, delete, and password changes.

Question 5

Directory Service Access

Answer 5

Tracks changes to Active Directory objects.

Question 6

4 Subcategories of Directory Service

Answer 6

1. Directory Service Access
2. Directory Service Changes
3. Directory Service Replication
4. Detailed Directory Service Replication

Question 7

What is the difference between Directory Service Access Audit Policy and Directory Service Changes Audit Policy?

Answer 7

Directory Service Access tells when a change was made.

Directory Service Changes records the values for the original setting as well as the values for the change.

Question 8

auditpol/set/

Answer 8

cmd to enable auditing for individual categories

Question 9

Logon Audit Policy

Answer 9

Tracks login/off on local system or when network connection is made.

Question 10

Object Access Audit Policy

Answer 10

Tracks access to files , folders, printers, certificate authority actions, access to specific registry settings, or access to specific Internet Information Services Metabase settings.

Question 11

Policy Change Audit Policy

Answer 11

Tracks changes to user rights, trust relationships, IPsec and Kerberos policies or audit policies.

Question 12

Priviledge Use Audit Policy

Answer 12

Tracks when a user exercises a user right or when admin takes ownership of an object.

Question 13

Process Tracking Audit Policy

Answer 13

Records actions taken by applications, which is mainly used for debugging and tracking.

Question 14

System Audit Policy

Answer 14

Tracks system shutdown, restart, or system services starts.

Question 15

Where must auditing be enabled for Directory Service Access & Object Access Audit Policies ?

Answer 15

1. Enable auditing in local security policy or Group Policy.

2. Configure auditing in specific objects to be tracked.
System Access Control List of AD object or NTFS file/folder

Question 16

How to configure logs to properly save audit data.

Answer 16

1. Use Event Log policies to configure Security log size and retention method.
2. Preserve logged actions by configuring to not overwrite events.
3. Enable “Audit: Shut down system immediately if unable to log security audits” (aka Crash On Audit Fail)

Question 17

What is needed to make Advanced Auditing Changes in pre WinServer’08 R2 systems?

Answer 17

auditpol.exe