Windows 11 Advanced Audit Policy Configuration: 27 Checks

Audits the results of validation tests on credentials submitted for an account logon request, recorded on the machine authoritative for the credentials.

This rule fails when credentialValidation is not SUCCESS_AND_FAILURE.

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.

Audits creation, modification, deletion, and membership changes of application groups used by Windows Authorization Manager.

This rule fails when applicationGroupManagement is not SUCCESS_AND_FAILURE.

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.

Audits security group management, including when a security group is created, changed, or deleted and when a member is added to or removed from a security group.

This rule fails when securityGroupManagement does not include SUCCESS (must be SUCCESS or SUCCESS_AND_FAILURE).

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.

Audits user account management, including creation, change, deletion, rename, enable/disable, and password set or change operations.

This rule fails when userAccountManagement is not SUCCESS_AND_FAILURE.

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.

Audits when Plug and Play detects that an external device is connected to the system.

This rule fails when plugAndPlayEvents does not include SUCCESS (must be SUCCESS or SUCCESS_AND_FAILURE).

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.

Audits the creation of a process, recording the program and the user or program that created it.

This rule fails when processCreation does not include SUCCESS (must be SUCCESS or SUCCESS_AND_FAILURE).

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.

Audits when a user account is locked out after too many failed logon attempts.

This rule fails when accountLockout does not include FAILURE (must be FAILURE or SUCCESS_AND_FAILURE).

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.

Audits the group membership information contained in a user's logon token, generated on the machine where the logon session is created.

This rule fails when groupMembership does not include SUCCESS (must be SUCCESS or SUCCESS_AND_FAILURE).

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.

Audits when a user logs off from the system, recorded on the accessed computer.

This rule fails when logoff does not include SUCCESS (must be SUCCESS or SUCCESS_AND_FAILURE).

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.

Audits each attempt by a user to log on to the system, recorded on the accessed computer.

This rule fails when logon is not SUCCESS_AND_FAILURE.

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.

Audits other logon/logoff-related events such as Remote Desktop session disconnects and reconnects, RunAs usage, and workstation locking and unlocking.

This rule fails when otherLogonLogoffEvents is not SUCCESS_AND_FAILURE.

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.

Audits use of a special logon, which carries administrator-equivalent privileges and can elevate a process to a higher level.

This rule fails when specialLogon does not include SUCCESS (must be SUCCESS or SUCCESS_AND_FAILURE).

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.

Audits attempts to access individual files and folders on a shared folder.

This rule fails when detailedFileShare does not include FAILURE (must be FAILURE or SUCCESS_AND_FAILURE).

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.

Audits attempts to access a shared folder.

This rule fails when fileShare is not SUCCESS_AND_FAILURE.

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.

Audits events generated by management of Task Scheduler jobs and COM+ objects.

This rule fails when otherObjectAccessEvents is not SUCCESS_AND_FAILURE.

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.

Audits user attempts to access file system objects on a removable storage device, for both successful and failed access requests.

This rule fails when removableStorage is not SUCCESS_AND_FAILURE.

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.

Audits changes to the audit policy, including system audit policy changes and SACL changes on objects.

This rule fails when auditPolicyChange does not include SUCCESS (must be SUCCESS or SUCCESS_AND_FAILURE).

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.

Audits changes to authentication policy, such as trust creation or removal, Kerberos policy changes, and security-access grants.

This rule fails when authenticationPolicyChange does not include SUCCESS (must be SUCCESS or SUCCESS_AND_FAILURE).

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.

Audits changes to authorization policy, including user-right assignments and changes to object permissions and access policies.

This rule fails when authorizationPolicyChange does not include SUCCESS (must be SUCCESS or SUCCESS_AND_FAILURE).

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.

Audits changes to Windows Firewall (Microsoft Protection Service, MPSSVC) policy rules and the active rule set.

This rule fails when mpssvcRuleLevelPolicyChange is not SUCCESS_AND_FAILURE.

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.

Audits other policy change events such as EFS Data Recovery Agent policy changes, Windows Filtering Platform filter changes, and Cryptographic Next Generation operations.

This rule fails when otherPolicyChangeEvents does not include FAILURE (must be FAILURE or SUCCESS_AND_FAILURE).

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.

Audits when a user account or service uses a sensitive privilege, such as acting as part of the operating system, debugging programs, or loading device drivers.

This rule fails when sensitivePrivilegeUse is not SUCCESS.

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.

Audits activities of the IPsec driver, including dropped inbound packets that fail integrity or replay checks and IPsec service start and stop events.

This rule fails when ipsecDriver is not SUCCESS_AND_FAILURE.

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.

Audits other system events, including Windows Firewall service and driver start, stop, and failure events.

This rule fails when otherSystemEvents is not SUCCESS_AND_FAILURE.

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.

Audits changes in the security state of the system, such as security subsystem startup and shutdown and system time changes.

This rule fails when securityStateChange does not include SUCCESS (must be SUCCESS or SUCCESS_AND_FAILURE).

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.

Audits the loading of extension code such as authentication and notification packages by the security subsystem, and service installation.

This rule fails when securitySystemExtension does not include SUCCESS (must be SUCCESS or SUCCESS_AND_FAILURE).

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.

Audits violations of the integrity of the security subsystem, including dropped audit messages, code integrity failures, and cryptographic operation failures.

This rule fails when systemIntegrity is not SUCCESS_AND_FAILURE.

Rationale: Without adequate audit settings, security incidents may go undetected and too little evidence is left for forensic analysis; auditing this subcategory records the relevant activity in the Security event log.

Impact: Enabling this audit subcategory generates additional entries in the Security event log.