Windows Server 2003 Recommended Baseline Security

Unclassified ITSG for Windows Server 2003
4.4 Local Policies
4.4.1 Audit Policy
4.4.1.1 Audit account logon events
AuditAccountLogon = 3
The ‘AuditAccountLogon’ defines types of logon events to audit. The setting ‘3’ audits ‘success’
and ‘fail’ events. ‘Success’ events can determine who accessed the system during an incident.
‘Fail’ events provide insight to password guessing attacks.
4.4.1.2 Audit account management
AuditAccountManage = 3
The ‘AuditAccountManage’ defines types of logon events to audit. The setting ‘3’ audits
‘success’ and ‘fail’ events. ‘Success’ events can be used in investigations, monitoring accounts at
the time of an incident. ‘Fail’ attempts can determine if users are probing the system for
vulnerabilities.
4.4.1.3 Audit directory service access
AuditDSAccess = 3
The ‘AuditDSAccess‘ defines types of logon events to audit. The setting ‘3’ audits ‘success’ and
‘fail’ events. The Directory Service holds crucial information for the Domain. Knowledge of
access during an incident can provide valuable information about Active Directory objects
accessed during an attack.
4.4.1.4 Audit logon events
AuditLogonEvents = 3
The ‘AuditLogonEvents’ defines types of logon events to audit. The setting ‘3’ audits ‘success’
and ‘fail’ events. ‘Success’ events can be used to determine who was accessing the system
during an incident. ‘Fail’ logon attempts can determine if the system is under a password
guessing attack.
4.4.1.5 Audit object access
AuditObjectAccess = 2
The ‘AuditObjectAccess’ defines the type of logon events that will be audited. The setting ‘2’
audits failed events. Failed attempts can be monitored to determine if any users are probing the
system for vulnerabilities.
48 March 2004 Server Policy Files