Windows Logging Configuration: Audit Policy Configuration

Transcription

1 Windows Logging Configuration: Audit Policy Configuration

2 Windows Auditing Windows audit policy requires computer level and in some cases object level configuration. At the computer level, Windows has 9 audit policies that can be enabled for success and/or failure. Audit account logon events Audit account management Audit directory service access Audit logon events Audit object access Audit policy change Audit privilege use Audit process tracking Audit system events Of these 9 audit policies, 2 require object level configuration as well. Object Access Normally we recommend disabling this policy except for specific computer where you need to audit access to files. Then only enable auditing on the specific files or folders where necessary and only for the specific groups and types of access necessary. For core functionally, you may leave this policy disabled. Directory Service This policy must be enabled on domain controllers in order for events related to changes on organizational unit and group policy objects to be logged. This important to core filter functionality. In addition to enabling this audit policy at the computer level, you must also enable specific object level audit policies on OUs and GPOS in Active Directory Users and Computers which is described under Active Directory Object Level Auditing below. Note that audit directory service access has no effect on member servers only domain controllers. Our technology requires this policy enabled on domain controllers. Enabling it on member servers won t harm anything.

3 Computer Level Audit Policy For core functionality enable: Failure Audit account logon events Audit account management Audit directory service access Audit logon events Audit object access Audit policy change Audit privilege use Audit process tracking Audit system events There are 2 ways to configure this audit policy. 1. Local Policy This is not the preferred method for computers that are members of an Active Directory domain since group policy can and should be used to centrally administer consistent policy configuration. Moreover, for any computer that is a member of a domain, the local policy configurations described in this section will be overridden by audit policies defined in any group policy objects applied to this computer. Therefore this method should only be used on standalone computers that is computers that do not belong to an Active Directory domain. You can configure the local policy either interactively or you can script it using a security template and. Interactive Open Local Security Policy in Administrative Tools and drill down to the Security Settings\Local Policies\Audit Policy folder and enable the audit policies as defined above. Note: if any of the policies are read-only this indicates the computer is a member of a domain and receiving audit policy via a group policy object in Active Directory. You cannot override group policies with the local policy. You must change the group policy object. To determine which group policy object is impacting the computer s audit policy run gpresult /v. Command prompt (script) Export this embedded security template to a folder on the server. Open a command prompt and change directory to that folder. Run secedit /configure /DB audipolicy /cfg auditpolicy.inf /log auditpolicy.log. This command configures the local computer with the policies defined in the template. This command can be scripted in a batch file (*.cmd) which is attached below. Just make sure the template file, auditpolicy.inf, is in the same folder as where the batch file is started. AuditPolicy.inf audipolicy.cmd

4 2. Group Policy This is the preferred method for all computers that are members of an Active Directory domain. This must be performed for each domain in the forest. There is no way to configure a forest-wide audit policy. Create a group policy object that is applied to all member servers (non domain controllers) being monitored. For instance if all your servers are in an organizational unit named Servers, create and link a GPO to the Servers OU. Edit the GPO and maneuver to the Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy folder and configure the policies according to the chart above. Follow up by logging onto one of the member servers and confirming the GPO is effect: a) Run gpudate to force immediate refresh of group policy b) Run gpresult /v to obtain a report of the group policy configurations in effect. c) Examine the audit policy section of gpresult s output and confirm the audit policy matches what you expect Note that the above steps do not result in domain controllers being configured. This is because all domain controller computer accounts necessarily reside in the Domain Controllers OU. Therefore, edit the Default Domain Controllers Policy GPO linked to that OU and configure the same audit policy. Logon to one of the domain controllers and perform the same confirmation process described above to make sure domain controllers have appropriate audit policy. Active Directory Object Level Auditing This enables auditing of: Permission changes on organizational units Modification of group policy related properties on OUs Modification of group policy objects Permission changes on group policy objects 1. Open Active Directory Users and Computers 2. Select View\Advanced Features 3. Right click on the root of the domain and select properties 4. Select the security tab 5. Click advanced 6. Select the Auditing tab 7. Add the following audit entries Who Object type Object Everyone organizationalunit Change Property /Failure Everyone organizationalunit Write gpoptions Everyone organizationalunit Write gplink

5 Everyone grouppolicycontainer Write All Properties Everyone grouppolicycontainer Change For a demonstration watch this video. Active Directory Object Level Auditing.wmv