Policy CSP - Audit

AccountLogon_AuditCredentialValidation

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/AccountLogon_AuditCredentialValidation

This policy setting allows you to audit events generated by validation tests on user account logon credentials. Events in this subcategory occur only on the computer that's authoritative for those credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative.

Volume: High on domain controllers.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Credential Validation
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Account Logon

AccountLogon_AuditKerberosAuthenticationService

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/AccountLogon_AuditKerberosAuthenticationService

This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests.

• If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests.

• If you don't configure this policy setting, no audit event is generated after a Kerberos authentication TGT request.

Volume: High on Kerberos Key Distribution Center servers.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Kerberos Authentication Service
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Account Logon

AccountLogon_AuditKerberosServiceTicketOperations

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/AccountLogon_AuditKerberosServiceTicketOperations

This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts.

• If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests.

• If you don't configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account.

Volume: Low.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Kerberos Service Ticket Operations
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Account Logon

AccountLogon_AuditOtherAccountLogonEvents

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/AccountLogon_AuditOtherAccountLogonEvents

This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that aren't credential validation or Kerberos tickets. Currently, there are no events in this subcategory.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Other Account Logon Events
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Account Logon

AccountLogonLogoff_AuditAccountLockout

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/AccountLogonLogoff_AuditAccountLockout

This policy setting allows you to audit events generated by a failed attempt to log on to an account that's locked out. If you configure this policy setting, an audit event is generated when an account can't log on to a computer because the account is locked out. Success audits record successful attempts and Failure audits record unsuccessful attempts. Logon events are essential for understanding user activity and to detect potential attacks.

Volume: Low.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	1

Allowed values:

Value	Description
0	Off/None.
1 (Default)	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Account Lockout
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Logon/Logoff

AccountLogonLogoff_AuditGroupMembership

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/AccountLogonLogoff_AuditGroupMembership

This policy allows you to audit the group membership information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged-on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group membership information can't fit in a single security audit event.

Volume: Low on a client computer. Medium on a domain controller or a network server.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Group Membership
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Logon/Logoff

AccountLogonLogoff_AuditIPsecExtendedMode

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/AccountLogonLogoff_AuditIPsecExtendedMode

This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations.

• If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.

• If you don't configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation.

Volume: High.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit IPsec Extended Mode
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Logon/Logoff

AccountLogonLogoff_AuditIPsecMainMode

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/AccountLogonLogoff_AuditIPsecMainMode

This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations.

• If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.

• If you don't configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation.

Volume: High.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit IPsec Main Mode
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Logon/Logoff

AccountLogonLogoff_AuditIPsecQuickMode

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/AccountLogonLogoff_AuditIPsecQuickMode

This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you don't configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation.

Volume: High.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit IPsec Quick Mode
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Logon/Logoff

AccountLogonLogoff_AuditLogoff

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/AccountLogonLogoff_AuditLogoff

This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged-on to.

• If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions.

• If you don't configure this policy setting, no audit event is generated when a logon session is closed.

Volume: Low.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	1

Allowed values:

Value	Description
0	Off/None.
1 (Default)	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Logoff
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Logon/Logoff

AccountLogonLogoff_AuditLogon

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/AccountLogonLogoff_AuditLogon

This policy setting allows you to audit events generated by user account logon attempts on the computer. Events in this subcategory are related to the creation of logon sessions and occur on the computer which was accessed. For an interactive logon, the security audit event is generated on the computer that the user account logged-on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. The following events are included: Successful logon attempts. Failed logon attempts. Logon attempts using explicit credentials. This event is generated when a process attempts to log on an account by explicitly specifying that account's credentials. This most commonly occurs in batch logon configurations, such as scheduled tasks or when using the RUNAS command. Security identifiers (SIDs) were filtered and not allowed to log on.

Volume: Low on a client computer. Medium on a domain controller or a network server.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	1

Allowed values:

Value	Description
0	Off/None.
1 (Default)	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Logon
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Logon/Logoff

AccountLogonLogoff_AuditNetworkPolicyServer

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/AccountLogonLogoff_AuditNetworkPolicyServer

This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock.

• If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts.

• If you don't configure this policy settings, IAS and NAP user access requests aren't audited.

Volume: Medium or High on NPS and IAS server. No volume on other computers.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	3

Allowed values:

Value	Description
0	Off/None.
1	Success.
2	Failure.
3 (Default)	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Network Policy Server
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Logon/Logoff

AccountLogonLogoff_AuditOtherLogonLogoffEvents

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents

This policy setting allows you to audit other logon/logoff-related events that aren't covered in the "Logon/Logoff" policy setting such as the following: Terminal Services session disconnections. New Terminal Services sessions. Locking and unlocking a workstation. Invoking a screen saver. Dismissal of a screen saver. Detection of a Kerberos replay attack, in which a Kerberos request was received twice with identical information. This condition could be caused by network misconfiguration. Access to a wireless network granted to a user or computer account. Access to a wired 802.1x network granted to a user or computer account.

Volume: Low.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Other Logon Logoff Events
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Logon/Logoff

AccountLogonLogoff_AuditSpecialLogon

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/AccountLogonLogoff_AuditSpecialLogon

This policy setting allows you to audit events generated by special logons such as the following: The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged-on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged.

Volume: Low.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	1

Allowed values:

Value	Description
0	Off/None.
1 (Default)	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Special Logon
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Logon/Logoff

AccountLogonLogoff_AuditUserDeviceClaims

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/AccountLogonLogoff_AuditUserDeviceClaims

This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged-on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. User claims are added to a logon token when claims are included with a user's account attributes in Active Directory. Device claims are added to the logon token when claims are included with a device's computer account attributes in Active Directory. In addition, compound identity must be enabled for the domain and on the computer where the user logged on. When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the user and device claims information can't fit in a single security audit event.

Volume: Low on a client computer. Medium on a domain controller or a network server.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit User Device Claims
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Logon/Logoff

AccountManagement_AuditApplicationGroupManagement

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/AccountManagement_AuditApplicationGroupManagement

This policy setting allows you to audit events generated by changes to application groups such as the following: Application group is created, changed, or deleted. Member is added or removed from an application group.

• If you configure this policy setting, an audit event is generated when an attempt to change an application group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts.

• If you don't configure this policy setting, no audit event is generated when an application group changes.

Volume: Low.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Application Group Management
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Account Management

AccountManagement_AuditComputerAccountManagement

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/AccountManagement_AuditComputerAccountManagement

This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted.

• If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts.

• If you don't configure this policy setting, no audit event is generated when a computer account changes.

Volume: Low.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Computer Account Management
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Account Management

AccountManagement_AuditDistributionGroupManagement

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/AccountManagement_AuditDistributionGroupManagement

This policy setting allows you to audit events generated by changes to distribution groups such as the following: Distribution group is created, changed, or deleted. Member is added or removed from a distribution group. Distribution group type is changed.

• If you configure this policy setting, an audit event is generated when an attempt to change a distribution group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts.

• If you don't configure this policy setting, no audit event is generated when a distribution group changes.

Note

Events in this subcategory are logged only on domain controllers.

Volume: Low.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Distribution Group Management
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Account Management

AccountManagement_AuditOtherAccountManagementEvents

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/AccountManagement_AuditOtherAccountManagementEvents

This policy setting allows you to audit events generated by other user account changes that aren't covered in this category, such as the following: The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. Changes to the Default Domain Group Policy under the following Group Policy paths: Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy.

Volume: Low.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Other Account Management Events
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Account Management

AccountManagement_AuditSecurityGroupManagement

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/AccountManagement_AuditSecurityGroupManagement

This policy setting allows you to audit events generated by changes to security groups such as the following: Security group is created, changed, or deleted. Member is added or removed from a security group. Group type is changed.

• If you configure this policy setting, an audit event is generated when an attempt to change a security group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts.

• If you don't configure this policy setting, no audit event is generated when a security group changes.

Volume: Low.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	1

Allowed values:

Value	Description
0	Off/None.
1 (Default)	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Security Group Management
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Account Management

AccountManagement_AuditUserAccountManagement

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/AccountManagement_AuditUserAccountManagement

This policy setting allows you to audit changes to user accounts. Events include the following: A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. A user account's password is set or changed. A security identifier (SID) is added to the SID History of a user account. The Directory Services Restore Mode password is configured. Permissions on administrative user accounts are changed. Credential Manager credentials are backed up or restored.

• If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts.

• If you don't configure this policy setting, no audit event is generated when a user account changes.

Volume: Low.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	1

Allowed values:

Value	Description
0	Off/None.
1 (Default)	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit User Account Management
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Account Management

DetailedTracking_AuditDPAPIActivity

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/DetailedTracking_AuditDPAPIActivity

This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see How to Use Data Protection.

• If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests.

• If you don't configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI.

Volume: Low.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit DPAPI Activity
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Detailed Tracking

DetailedTracking_AuditPNPActivity

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/DetailedTracking_AuditPNPActivity

This policy setting allows you to audit when plug and play detects an external device.

• If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category.

• If you don't configure this policy setting, no audit event is generated when an external device is detected by plug and play.

Volume: Low.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit PNP Activity
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Detailed Tracking

DetailedTracking_AuditProcessCreation

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/DetailedTracking_AuditProcessCreation

This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited.

• If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts.

• If you don't configure this policy setting, no audit event is generated when a process is created.

Volume: Depends on how the computer is used.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Process Creation
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Detailed Tracking

DetailedTracking_AuditProcessTermination

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/DetailedTracking_AuditProcessTermination

This policy setting allows you to audit events generated when a process ends.

• If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts.

• If you don't configure this policy setting, no audit event is generated when a process ends.

Volume: Depends on how the computer is used.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Process Termination
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Detailed Tracking

DetailedTracking_AuditRPCEvents

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/DetailedTracking_AuditRPCEvents

This policy setting allows you to audit inbound remote procedure call (RPC) connections.

• If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts.

• If you don't configure this policy setting, no audit event is generated when a remote RPC connection is attempted.

Volume: High on RPC servers.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit RPC Events
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Detailed Tracking

DetailedTracking_AuditTokenRightAdjusted

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/DetailedTracking_AuditTokenRightAdjusted

This policy setting allows you to audit events generated by adjusting the privileges of a token.

Volume: High.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Token Right Adjusted
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Detailed Tracking

DSAccess_AuditDetailedDirectoryServiceReplication

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/DSAccess_AuditDetailedDirectoryServiceReplication

This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers.

Volume: High.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Detailed Directory Service Replication
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > DS Access

DSAccess_AuditDirectoryServiceAccess

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/DSAccess_AuditDirectoryServiceAccess

This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. Only AD DS objects with a matching system access control list (SACL) are logged. Events in this subcategory are similar to the Directory Service Access events available in previous versions of Windows.

Volume: High on domain controllers. None on client computers.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Directory Service Access
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > DS Access

DSAccess_AuditDirectoryServiceChanges

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/DSAccess_AuditDirectoryServiceChanges

This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. When possible, events logged in this subcategory indicate the old and new values of the object's properties. Events in this subcategory are logged only on domain controllers, and only objects in AD DS with a matching system access control list (SACL) are logged.

Note

Actions on some objects and properties don't cause audit events to be generated due to settings on the object class in the schema.

• If you configure this policy setting, an audit event is generated when an attempt to change an object in AD DS is made. Success audits record successful attempts, however unsuccessful attempts are NOT recorded.

• If you don't configure this policy setting, no audit event is generated when an attempt to change an object in AD DS object is made.

Volume: High on domain controllers only.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Directory Service Changes
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > DS Access

DSAccess_AuditDirectoryServiceReplication

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/DSAccess_AuditDirectoryServiceReplication

This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers.

• If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication.

• If you don't configure this policy setting, no audit event is generated during AD DS replication.

Volume: Medium on domain controllers. None on client computers.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Directory Service Replication
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > DS Access

ObjectAccess_AuditApplicationGenerated

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/ObjectAccess_AuditApplicationGenerated

This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. Events in this subcategory include: Creation of an application client context. Deletion of an application client context. Initialization of an application client context. Other application operations using the Windows Auditing APIs.

Volume: Depends on the applications that are generating them.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Application Generated
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Object Access

ObjectAccess_AuditCentralAccessPolicyStaging

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/ObjectAccess_AuditCentralAccessPolicyStaging

This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. If you configure this policy setting, an audit event is generated each time a user accesses an object and the permission granted by the current central access policy on the object differs from that granted by the proposed policy. The resulting audit event will be generated as follows: 1) Success audits, when configured, records access attempts when the current central access policy grants access but the proposed policy denies access. 2) Failure audits when configured records access attempts when: a) The current central access policy doesn't grant access but the proposed policy grants access. b) A principal requests the maximum access rights they're allowed and the access rights granted by the current central access policy are different than the access rights granted by the proposed policy. Volume: Potentially high on a file server when the proposed policy differs significantly from the current central access policy.

Volume: Potentially high on a file server when the proposed policy differs significantly from the current central access policy.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Central Access Policy Staging
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Object Access

ObjectAccess_AuditCertificationServices

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/ObjectAccess_AuditCertificationServices

This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. AD CS operations include the following: AD CS startup/shutdown/backup/restore. Changes to the certificate revocation list (CRL). New certificate requests. Issuing of a certificate. Revocation of a certificate. Changes to the Certificate Manager settings for AD CS. Changes in the configuration of AD CS. Changes to a Certificate Services template. Importing of a certificate. Publishing of a certification authority certificate is to Active Directory Domain Services. Changes to the security permissions for AD CS. Archival of a key. Importing of a key. Retrieval of a key. Starting of Online Certificate Status Protocol (OCSP) Responder Service. Stopping of Online Certificate Status Protocol (OCSP) Responder Service.

Volume: Medium or Low on computers running Active Directory Certificate Services.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Certification Services
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Object Access

ObjectAccess_AuditDetailedFileShare

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/ObjectAccess_AuditDetailedFileShare

This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access.

• If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures.

Note

There are no system access control lists (SACLs) for shared folders.

• If this policy setting is enabled, access to all shared files and folders on the system is audited.

Volume: High on a file server or domain controller because of SYSVOL network access required by Group Policy.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Detailed File Share
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Object Access

ObjectAccess_AuditFileShare

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/ObjectAccess_AuditFileShare

This policy setting allows you to audit attempts to access a shared folder.

• If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder.

• If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures.

Note

There are no system access control lists (SACLs) for shared folders.

• If this policy setting is enabled, access to all shared folders on the system is audited.

Volume: High on a file server or domain controller because of SYSVOL network access required by Group Policy.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit File Share
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Object Access

ObjectAccess_AuditFileSystem

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/ObjectAccess_AuditFileSystem

This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see< https://go.microsoft.com/fwlink/?LinkId=122083>.

• If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts.

• If you don't configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL.

Note

You can set a SACL on a file system object using the Security tab in that object's Properties dialog box.

Volume: Depends on how the file system SACLs are configured.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit File System
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Object Access

ObjectAccess_AuditFilteringPlatformConnection

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/ObjectAccess_AuditFilteringPlatformConnection

This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). The following events are included: The Windows Firewall Service blocks an application from accepting incoming connections on the network. The WFP allows a connection. The WFP blocks a connection. The WFP permits a bind to a local port. The WFP blocks a bind to a local port. The WFP allows a connection. The WFP blocks a connection. The WFP permits an application or service to listen on a port for incoming connections. The WFP blocks an application or service to listen on a port for incoming connections.

• If you configure this policy setting, an audit event is generated when connections are allowed or blocked by the WFP. Success audits record events generated when connections are allowed and Failure audits record events generated when connections are blocked.

• If you don't configure this policy setting, no audit event is generated when connected are allowed or blocked by the WFP.

Volume: High.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Filtering Platform Connection
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Object Access

ObjectAccess_AuditFilteringPlatformPacketDrop

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/ObjectAccess_AuditFilteringPlatformPacketDrop

This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP).

Volume: High.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Filtering Platform Packet Drop
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Object Access

ObjectAccess_AuditHandleManipulation

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/ObjectAccess_AuditHandleManipulation

This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events.

• If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts.

• If you don't configure this policy setting, no audit event is generated when a handle is manipulated.

Note

Events in this subcategory generate events only for object types where the corresponding Object Access subcategory is enabled. For example, if File system object access is enabled, handle manipulation security audit events are generated. If Registry object access isn't enabled, handle manipulation security audit events won't be generated.

Volume: Depends on how SACLs are configured.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Handle Manipulation
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Object Access

ObjectAccess_AuditKernelObject

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/ObjectAccess_AuditKernelObject

This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. Only kernel objects with a matching system access control list (SACL) generate security audit events.

Note

The Audit: Audit the access of global system objects policy setting controls the default SACL of kernel objects.

Volume: High if auditing access of global system objects is enabled.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Kernel Object
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Object Access

ObjectAccess_AuditOtherObjectAccessEvents

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/ObjectAccess_AuditOtherObjectAccessEvents

This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. For scheduler jobs, the following are audited: Job created. Job deleted. Job enabled. Job disabled. Job updated. For COM+ objects, the following are audited: Catalog object added. Catalog object updated. Catalog object deleted.

Volume: Low.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Other Object Access Events
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Object Access

ObjectAccess_AuditRegistry

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/ObjectAccess_AuditRegistry

This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL.

• If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts.

• If you don't configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL.

Note

You can set a SACL on a registry object using the Permissions dialog box.

Volume: Depends on how registry SACLs are configured.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Registry
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Object Access

ObjectAccess_AuditRemovableStorage

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/ObjectAccess_AuditRemovableStorage

This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested.

• If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts.

• If you don't configure this policy setting, no audit event is generated when an account accesses a file system object on a removable storage.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Removable Storage
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Object Access

ObjectAccess_AuditSAM

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/ObjectAccess_AuditSAM

This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. SAM objects include the following: SAM_ALIAS -- A local group. SAM_GROUP -- A group that isn't a local group. SAM_USER - A user account. SAM_DOMAIN - A domain. SAM_SERVER - A computer account.

• If you configure this policy setting, an audit event is generated when an attempt to access a kernel object is made. Success audits record successful attempts and Failure audits record unsuccessful attempts.

• If you don't configure this policy setting, no audit event is generated when an attempt to access a kernel object is made.

Note

Only the System Access Control List (SACL) for SAM_SERVER can be modified. Volume: High on domain controllers.

Volume: High on domain controllers. For more information about reducing the number of events generated by auditing the access of global system objects, see Audit the access of global system objects.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit SAM
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Object Access

PolicyChange_AuditAuthenticationPolicyChange

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/PolicyChange_AuditAuthenticationPolicyChange

This policy setting allows you to audit events generated by changes to the authentication policy such as the following: Creation of forest and domain trusts. Modification of forest and domain trusts. Removal of forest and domain trusts. Changes to Kerberos policy under Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy. Granting of any of the following user rights to a user or group: Access This Computer From the Network. Allow Logon Locally. Allow Logon Through Terminal Services. Logon as a Batch Job. Logon a Service. Namespace collision. For example, when a new trust has the same name as an existing namespace name.

• If you configure this policy setting, an audit event is generated when an attempt to change the authentication policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts.

• If you don't configure this policy setting, no audit event is generated when the authentication policy is changed.

Note

The security audit event is logged when the group policy is applied. It doesn't occur at the time when the settings are modified.

Volume: Low.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	1

Allowed values:

Value	Description
0	Off/None.
1 (Default)	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Authentication Policy Change
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Policy Change

PolicyChange_AuditAuthorizationPolicyChange

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/PolicyChange_AuditAuthorizationPolicyChange

This policy setting allows you to audit events generated by changes to the authorization policy such as the following: Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that aren't audited through the "Authentication Policy Change" subcategory. Removal of user rights (privileges), such as SeCreateTokenPrivilege, that aren't audited through the "Authentication Policy Change" subcategory. Changes in the Encrypted File System (EFS) policy. Changes to the Resource attributes of an object. Changes to the Central Access Policy (CAP) applied to an object.

• If you configure this policy setting, an audit event is generated when an attempt to change the authorization policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts.

• If you don't configure this policy setting, no audit event is generated when the authorization policy changes.

Volume: Low.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Authorization Policy Change
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Policy Change

PolicyChange_AuditFilteringPlatformPolicyChange

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/PolicyChange_AuditFilteringPlatformPolicyChange

This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP) such as the following: IPsec services status. Changes to IPsec policy settings. Changes to Windows Firewall policy settings. Changes to WFP providers and engine.

• If you configure this policy setting, an audit event is generated when a change to the WFP is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts.

• If you don't configure this policy setting, no audit event is generated when a change occurs to the WFP.

Volume: Low.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Filtering Platform Policy Change
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Policy Change

PolicyChange_AuditMPSSVCRuleLevelPolicyChange

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange

This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. Events include the following: Reporting of active policies when Windows Firewall service starts. Changes to Windows Firewall rules. Changes to Windows Firewall exception list. Changes to Windows Firewall settings. Rules ignored or not applied by Windows Firewall Service. Changes to Windows Firewall Group Policy settings.

• If you configure this policy setting, an audit event is generated by attempts to change policy rules used by the MPSSVC. Success audits record successful attempts and Failure audits record unsuccessful attempts.

• If you don't configure this policy setting, no audit event is generated by changes in policy rules used by the MPSSVC.

Volume: Low.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit MPSSVC Rule Level Policy Change
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Policy Change

PolicyChange_AuditOtherPolicyChangeEvents

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/PolicyChange_AuditOtherPolicyChangeEvents

This policy setting allows you to audit events generated by other security policy changes that aren't audited in the policy change category, such as the following: Trusted Platform Module (TPM) configuration changes. Kernel-mode cryptographic self tests. Cryptographic provider operations. Cryptographic context operations or modifications. Applied Central Access Policies (CAPs) changes. Boot Configuration Data (BCD) modifications.

Volume: Low.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Other Policy Change Events
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Policy Change

PolicyChange_AuditPolicyChange

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/PolicyChange_AuditPolicyChange

This policy setting allows you to audit changes in the security audit policy settings such as the following: Settings permissions and audit settings on the Audit Policy object. Changes to the system audit policy. Registration of security event sources. De-registration of security event sources. Changes to the per-user audit settings. Changes to the value of CrashOnAuditFail. Changes to the system access control list on a file system or registry object. Changes to the Special Groups list.

Note

System access control list (SACL) change auditing is done when a SACL for an object changes and the policy change category is enabled. Discretionary access control list (DACL) and ownership changes are audited when object access auditing is enabled and the object's SACL is configured for auditing of DACL/Owner change.

Volume: Low.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	1

Allowed values:

Value	Description
0	Off/None.
1 (Default)	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Policy Change
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Policy Change

PrivilegeUse_AuditNonSensitivePrivilegeUse

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/PrivilegeUse_AuditNonSensitivePrivilegeUse

This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). The following privileges are non-sensitive: Access Credential Manager as a trusted caller. Access this computer from the network. Add workstations to domain. Adjust memory quotas for a process. Allow log on locally. Allow log on through Terminal Services. Bypass traverse checking. Change the system time. Create a pagefile. Create global objects. Create permanent shared objects. Create symbolic links. Deny access this computer from the network. Deny log on as a batch job. Deny log on as a service. Deny log on locally. Deny log on through Terminal Services. Force shutdown from a remote system. Increase a process working set. Increase scheduling priority. Lock pages in memory. Log on as a batch job. Log on as a service. Modify an object label. Perform volume maintenance tasks. Profile single process. Profile system performance. Remove computer from docking station. Shut down the system. Synchronize directory service data.

• If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful calls and Failure audits record unsuccessful calls.

• If you don't configure this policy setting, no audit event is generated when a non-sensitive privilege is called.

Volume: Very High.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Non Sensitive Privilege Use
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Privilege Use

PrivilegeUse_AuditOtherPrivilegeUseEvents

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/PrivilegeUse_AuditOtherPrivilegeUseEvents

Not used.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Other Privilege Use Events
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Privilege Use

PrivilegeUse_AuditSensitivePrivilegeUse

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/PrivilegeUse_AuditSensitivePrivilegeUse

This policy setting allows you to audit events generated when sensitive privileges (user rights) are used such as the following: A privileged service is called. One of the following privileges are called: Act as part of the operating system. Back up files and directories. Create a token object. Debug programs. Enable computer and user accounts to be trusted for delegation. Generate security audits. Impersonate a client after authentication. Load and unload device drivers. Manage auditing and security log. Modify firmware environment values. Replace a process-level token. Restore files and directories. Take ownership of files or other objects.

• If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful requests and Failure audits record unsuccessful requests.

• If you don't configure this policy setting, no audit event is generated when sensitive privilege requests are made.

Volume: High.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Sensitive Privilege Use
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Privilege Use

System_AuditIPsecDriver

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/System_AuditIPsecDriver

This policy setting allows you to audit events generated by the IPsec filter driver such as the following: Startup and shutdown of the IPsec services. Network packets dropped due to integrity check failure. Network packets dropped due to replay check failure. Network packets dropped due to being in plaintext. Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card isn't working correctly or the driver needs to be updated. Inability to process IPsec filters.

• If you configure this policy setting, an audit event is generated on an IPsec filter driver operation. Success audits record successful attempts and Failure audits record unsuccessful attempts.

• If you don't configure this policy setting, no audit event is generated on an IPSec filter driver operation.

Volume: Low.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit IPsec Driver
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > System

System_AuditOtherSystemEvents

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/System_AuditOtherSystemEvents

This policy setting allows you to audit any of the following events: Startup and shutdown of the Windows Firewall service and driver. Security policy processing by the Windows Firewall Service. Cryptography key file and migration operations.

Volume: Low.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	3

Allowed values:

Value	Description
0	Off/None.
1	Success.
2	Failure.
3 (Default)	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Other System Events
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > System

System_AuditSecurityStateChange

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/System_AuditSecurityStateChange

This policy setting allows you to audit events generated by changes in the security state of the computer such as the following events: Startup and shutdown of the computer. Change of system time. Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured.

Volume: Low.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	1

Allowed values:

Value	Description
0	Off/None.
1 (Default)	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Security State Change
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > System

System_AuditSecuritySystemExtension

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/System_AuditSecuritySystemExtension

This policy setting allows you to audit events related to security system extensions or services such as the following: A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It's used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account.

• If you configure this policy setting, an audit event is generated when an attempt is made to load a security system extension. Success audits record successful attempts and Failure audits record unsuccessful attempts.

• If you don't configure this policy setting, no audit event is generated when an attempt is made to load a security system extension.

Volume: Low. Security system extension events are generated more often on a domain controller than on client computers or member servers.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Off/None.
1	Success.
2	Failure.
3	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit Security System Extension
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > System

System_AuditSystemIntegrity

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1803 with KB4516045 [10.0.17134.1039] and later ✅ Windows 10, version 1809 with KB4516077 [10.0.17763.774] and later ✅ Windows 10, version 1903 with KB4512941 [10.0.18362.329] and later ✅ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Policy/Config/Audit/System_AuditSystemIntegrity

This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: Events that couldn't be written to the event log because of a problem with the auditing system. A process that uses a local procedure call (LPC) port that isn't valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. The detection of a Remote Procedure Call (RPC) that compromises system integrity. The detection of a hash value of an executable file that isn't valid as determined by Code Integrity. Cryptographic operations that compromise system integrity.

Volume: Low.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	3

Allowed values:

Value	Description
0	Off/None.
1	Success.
2	Failure.
3 (Default)	Success+Failure.

Group policy mapping:

Name	Value
Name	Audit System Integrity
Path	Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > System

Related articles

Policy configuration service provider