SV-92757r2_rule
V-78061
WINAU-000907
WINAU-000907
CAT II
10
Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Other System Events" with "Success" selected.
Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective.
Use the AuditPol tool to review the current Audit Policy configuration:
Open an elevated "Command Prompt" (run as administrator).
Enter "AuditPol /get /category:*"
Compare the AuditPol settings with the following.
If the system does not audit the following, this is a finding.
System >> Other System Events - Success
V-78061
False
WINAU-000907
Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective.
Use the AuditPol tool to review the current Audit Policy configuration:
Open an elevated "Command Prompt" (run as administrator).
Enter "AuditPol /get /category:*"
Compare the AuditPol settings with the following.
If the system does not audit the following, this is a finding.
System >> Other System Events - Success
M
1823