How can I ensure that system-level auditing is enabled.

vworthy · 10-16-2009, 07:58 AM

I am responsible for running vunerability scans weekly, after running these scans I have found one entry stating the the system level auditing was not either set correctly or is disabled. I have checked both system and software hives in the registry, showing the following settings: Under the audit tab, there is a entry for auditing the "everyone" group for failures, and the keys that are selected are Set Value, Create Subkey, and Delete. There is a check mark in Allow inheritable auditing entries from Parent to Propogate to this object.

I would appreciate help with this issue.

L8ians · 10-18-2009, 07:03 AM

Configure auditing on the "HKEY_LOCAL_MACHINE\Software" and "HKEY_LOCAL_MACHINE\System" hives to be all Failures for the Everyone group

vworthy · 10-19-2009, 06:51 AM

I have configured those hives, I am just unsure whether I have them set correctly. Under Access Control Settings I have Type Fail, Name Everyone, Access Full control, and Apply to This key and subkeys.

I also have all inheritable entries from parent to propagate to this object selected.

10-16-2009, 07:58 AM	#1 (permalink)
vworthy Registered User Join Date: Oct 2009 Posts: 2 OS: XP	How can I ensure that system-level auditing is enabled. I am responsible for running vunerability scans weekly, after running these scans I have found one entry stating the the system level auditing was not either set correctly or is disabled. I have checked both system and software hives in the registry, showing the following settings: Under the audit tab, there is a entry for auditing the "everyone" group for failures, and the keys that are selected are Set Value, Create Subkey, and Delete. There is a check mark in Allow inheritable auditing entries from Parent to Propogate to this object. I would appreciate help with this issue.

10-18-2009, 07:03 AM	#2 (permalink)
L8ians Registered User Join Date: Sep 2008 Location: INDIA Posts: 100 OS: 2008/2003 Server/xp sp2/Vista/Windows Seven	Re: How can I ensure that system-level auditing is enabled. Configure auditing on the "HKEY_LOCAL_MACHINE\Software" and "HKEY_LOCAL_MACHINE\System" hives to be all Failures for the Everyone group

10-19-2009, 06:51 AM	#3 (permalink)
vworthy Registered User Join Date: Oct 2009 Posts: 2 OS: XP	Re: How can I ensure that system-level auditing is enabled. I have configured those hives, I am just unsure whether I have them set correctly. Under Access Control Settings I have Type Fail, Name Everyone, Access Full control, and Apply to This key and subkeys. I also have all inheritable entries from parent to propagate to this object selected.