首页 »
下载PDF
 

Configure audit policies in your domain - Manual Process

1. Configure advanced audit policies 

Advanced audit policies help administrators exercise granular control over which activities get recorded in the logs, helping reduce event noise. We recommend configuring advanced audit policies on Windows Server 2008 and above.

  • Log in to any computer that has the Group Policy Management Console (GPMC) with Domain Admin credentials. 
  • Open the GPMC and, based on your setup, right-click Default Domain Controllers Policy or ADAuditPlusMSPolicy or ADAuditPlusWSPolicy, and select Edit.

    • Note: For the appropriate group policy, refer to the table below:
    To enable FIM on Right-click
    Domain controller Default Domain Controllers Policy GPO
    Windows server ADAuditPlusMSPolicy GPO
    Workstation ADAuditPlusWSPolicy GPO

  • In the Group Policy Management Editor, go to Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration, and configure the following settings:

    • Category Subcategory Audit events Purpose
    Object Access
    • Audit File System
    • Audit File Share
    • Audit Handle Manipulation
    • Success, Failure
    • Success
    • Success, Failure
    • File share auditing
    Policy Change
    • Audit Policy Change
    • Authorization Policy Change
    • Success, Failure
    • Success
    • File permission change auditing
    Configure advanced audit policies
2. Force advanced audit policies

When using advanced audit policies, ensure they are forced over legacy audit policies. 

  • Log in to any computer that has the GPMC with Domain Admin credentials. 
  • Open the GPMC and, based on your setup, right-click Default Domain Controllers Policy or ADAuditPlusMSPolicy or ADAuditPlusWSPolicy, then select Edit.

    • To enable FIM on Right-click
    Domain controller Default Domain Controllers Policy GPO
    Windows server ADAuditPlusMSPolicy GPO
    Workstation ADAuditPlusWSPolicy GPO

  • In the Group Policy Management Editor, go to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options.
  • Right-click Audit: Force audit policy subcategory settings from the right pane. 
  • Select Properties, then choose Enabled.
    • Force advanced audit policies
3. Configure legacy audit policies

Due to the unavailability of advanced audit policies in Windows Server 2003 and earlier versions, legacy audit policies need to be configured for these types of servers.

  • Log in to any computer that has the GPMC with Domain Admin credentials. 
  • Open the GPMC and, based on your setup, right-click Default Domain Controllers Policy or ADAuditPlusMSPolicy or ADAuditPlusWSPolicy, then select Edit.

    • To enable FIM on Right-click
    Domain controller Default Domain Controllers Policy GPO
    Windows server ADAuditPlusMSPolicy GPO
    Workstation ADAuditPlusWSPolicy GPO

  • In the Group Policy Management Editor, go to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies.
  • Double-click Audit Policy.
  • Right-click on the Object Access policy in the right pane. 
  • Select Properties, then check the box next to Success.
    • Configure legacy audit policies

In this article

我们的客户