WINDOWS AUDIT POLICY AND EVENT LOG SETTINGS
Turn on the Windows Security events that detection depends on: Microsoft's audit policy recommendations per subcategory, auditpol to read, set, back up and restore the policy, command lines in event 4688, Security log size and retention, and the events that show someone changed the policy or cleared the log. Event IDs themselves: see the Windows Security Event IDs sheet. Domain controllers: see also the Active Directory Defense sheet.
HOW THE POLICY IS APPLIED#
Two layers. Use the advanced one (subcategories, 58 in the MS-GPAC
list), not the old basic categories:
GPO: Computer Configuration > Policies > Windows Settings >
Security Settings > Advanced Audit Policy Configuration
Local: secpol.msc, or auditpol.exe from an elevated prompt
Keep this Security Option Enabled (it is Enabled by default) so the
basic categories cannot override the subcategories:
Local Policies > Security Options > "Audit: Force audit policy
subcategory settings (Windows Vista or later) to override audit
policy category settings"
# The registry value behind it is SCENoApplyLegacyAuditPolicy.
# Event 4719 is logged whenever the audit policy of the computer changes.
# In a domain, set the policy in a GPO; auditpol is for checking a host
# and for machines outside the domain.
READ THE CURRENT POLICY#
auditpol /get /category:* # every subcategory, effective auditpol /get /category:* /r > ap.csv # same, as CSV (report format) auditpol /get /subcategory:"Process Creation" auditpol /list /subcategory:* /v # names + GUIDs on this host auditpol /list /user /v # accounts with per-user policy auditpol /get /option:CrashOnAuditFail # Run elevated. Subcategory names follow the Windows display language; # the GUIDs below are fixed, so scripts that use them work everywhere.
MICROSOFT RECOMMENDATIONS#
From Microsoft's "Audit Policy Recommendations". DEFLT = Windows default, CL = client, SV = server, BASE = baseline, STR = stronger. S = success, F = failure, dc = domain controllers only, if = only when that role or feature is used, off = not audited, - = blank in Microsoft's table. Subcategories blank in every column are left out. SUBCATEGORY DEFLT CL-BASE CL-STR SV-BASE SV-STR Credential Validation off S S+F S+F S+F Kerberos Authentication Service - - S+F - S+F Kerberos Service Ticket Operations - - S+F - S+F Other Account Logon Events - - S+F - S+F Computer Account Management - S S+F S+Fdc S+F Other Account Management Events - S S+F S+F S+F Security Group Management - S S+F S+F S+F User Account Management S S S+F S+F S+F DPAPI Activity - - S+F - S+F Process Creation - S S+F S S+F Directory Service Access - - - Sdc+Fdc Sdc+Fdc Directory Service Changes - - - Sdc+Fdc Sdc+Fdc Account Lockout S - S - S IPsec Main Mode - - Sif+Fif - Sif+Fif Logoff S S S S S Logon S+F S+F S+F S+F S+F Network Policy Server S+F - - - - Other Logon/Logoff Events - - - - S+F Special Logon S S S+F S S+F Audit Policy Change S S+F S+F S+F S+F Authentication Policy Change S S S+F S S+F MPSSVC Rule-Level Policy Change - - S - S IPsec Driver - S+F S+F S+F S+F Other System Events S+F - - - - Security State Change S S+F S+F S+F S+F Security System Extension - S+F S+F S+F S+F System Integrity S+F S+F S+F S+F S+F # Logon: Success and Failure by default since Windows 10 1809 (Success # only before). Microsoft calls these a starting point: test the event # volume before production, and add what your detections need.
APPLY THE SERVER BASELINE WITH AUDITPOL#
# PowerShell, elevated. Names as on English Windows.
$sf = 'Credential Validation','Other Account Management Events',
'Security Group Management','User Account Management','Logon',
'Audit Policy Change','IPsec Driver','Security State Change',
'Security System Extension','System Integrity'
$s = 'Process Creation','Logoff','Special Logon',
'Authentication Policy Change','Computer Account Management'
foreach ($n in $sf) {
auditpol /set /subcategory:"$n" /success:enable /failure:enable }
foreach ($n in $s) { auditpol /set /subcategory:"$n" /success:enable }
# /success:enable alone leaves the Failure setting as it was.
# Domain controllers add (S+F): Directory Service Access, Directory
# Service Changes, Computer Account Management.
# By GUID (any language):
$g = '{0CCE922B-69AE-11D9-BED3-505054503030}' # Process Creation
auditpol /set /subcategory:$g /success:enable
SUBCATEGORY GUIDS#
From the MS-GPAC protocol specification (section 2.2.1.2).
{0CCE923F-69AE-11D9-BED3-505054503030} Credential Validation
{0CCE9242-69AE-11D9-BED3-505054503030} Kerberos Authentication Service
{0CCE9240-69AE-11D9-BED3-505054503030} Kerberos Service Ticket Operations
{0CCE9241-69AE-11D9-BED3-505054503030} Other Account Logon Events
{0CCE9236-69AE-11D9-BED3-505054503030} Computer Account Management
{0CCE923A-69AE-11D9-BED3-505054503030} Other Account Management Events
{0CCE9237-69AE-11D9-BED3-505054503030} Security Group Management
{0CCE9235-69AE-11D9-BED3-505054503030} User Account Management
{0CCE922D-69AE-11D9-BED3-505054503030} DPAPI Activity
{0CCE922B-69AE-11D9-BED3-505054503030} Process Creation
{0CCE923B-69AE-11D9-BED3-505054503030} Directory Service Access
{0CCE923C-69AE-11D9-BED3-505054503030} Directory Service Changes
{0CCE9217-69AE-11D9-BED3-505054503030} Account Lockout
{0CCE9218-69AE-11D9-BED3-505054503030} IPsec Main Mode
{0CCE9216-69AE-11D9-BED3-505054503030} Logoff
{0CCE9215-69AE-11D9-BED3-505054503030} Logon
{0CCE9243-69AE-11D9-BED3-505054503030} Network Policy Server
{0CCE921C-69AE-11D9-BED3-505054503030} Other Logon/Logoff Events
{0CCE921B-69AE-11D9-BED3-505054503030} Special Logon
{0CCE922F-69AE-11D9-BED3-505054503030} Audit Policy Change
{0CCE9230-69AE-11D9-BED3-505054503030} Authentication Policy Change
{0CCE9232-69AE-11D9-BED3-505054503030} MPSSVC Rule-Level Policy Change
{0CCE9213-69AE-11D9-BED3-505054503030} IPsec Driver
{0CCE9214-69AE-11D9-BED3-505054503030} Other System Events
{0CCE9210-69AE-11D9-BED3-505054503030} Security State Change
{0CCE9211-69AE-11D9-BED3-505054503030} Security System Extension
{0CCE9212-69AE-11D9-BED3-505054503030} System Integrity
BACK UP, RESTORE, RESET#
auditpol /backup /file:C:\audit\auditpolicy.csv auditpol /restore /file:C:\audit\auditpolicy.csv # Backup holds the system policy, per-user policy and audit options. auditpol /clear # disables ALL auditing + deletes per-user policy # auditpol /clear /y skips the prompt. Treat either as a red flag when # you see it in process creation events.
COMMAND LINES IN EVENT 4688#
Needs Audit Process Creation (Success) AND this policy: Computer Configuration > Administrative Templates > System > Audit Process Creation > Include command line in process creation events (Enabled) Intune/MDM CSP: ./Device/Vendor/MSFT/Policy/Config/ADMX_AuditSettings/IncludeCmdLine Registry value the policy writes (check it, set it through policy): $k = 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit' Get-ItemProperty $k -Name ProcessCreationIncludeCmdLine_Enabled # Anyone who can read the Security log can then read every command # line, including passwords typed as arguments: restrict log access.
SECURITY LOG SIZE AND RETENTION#
wevtutil gl Security # enabled, retention, maxSize (bytes), file
wevtutil gli Security # record count, file size, last write
wevtutil sl Security /ms:1073741824 # 1 GB; size is in BYTES
Group Policy (sizes in KB):
Administrative Templates > Windows Components > Event Log Service >
Security > Specify the maximum log file size (KB)
# Security log: default 20 MB; policy range 20 MB to 2 TB.
# Size it so the log covers your investigation window between SIEM
# collections; check the oldest event date after a busy day.
Retention when full:
wevtutil sl Security /rt:false # new events overwrite the oldest
wevtutil sl Security /rt:true # keep old events, drop new ones
wevtutil sl Security /rt:true /ab:true # archive the full log, start
# a new one (needs disk space)
# Policy "Control Event Log behavior when the log file reaches its
# maximum size" Enabled = new events are not written and are lost.
EVENTS THAT SHOW TAMPERING#
1102 The audit log was cleared Security
1104 The security log is now full Security
1100 The event logging service has shut down Security
4719 System audit policy was changed Security
4906 The CrashOnAuditFail value has changed Security
4912 Per User Audit Policy was changed Security
4688 process creation: watch auditpol.exe /clear or /set ... /success:
disable /failure:disable, and wevtutil cl / sl
# 4719, 4906 and 4912 are always logged, whatever the Audit Policy
# Change setting is.
CHECK THAT IT WORKS#
wevtutil qe Security /q:"*[System[(EventID=4688)]]" /c:3 /rd:true /f:text
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4719} -MaxEvents 5
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -MaxEvents 1 |
Format-List TimeCreated, Message # Process Command Line filled in?
# The Process Command Line field is empty until the policy above is on.
The recommendation table, subcategory GUIDs, auditpol and wevtutil syntax,
Group Policy paths, the CSP path, the registry value name, log size ranges
and event titles were checked against Microsoft Learn (Audit Policy
Recommendations, auditpol and wevtutil command references, command line
process auditing, Policy CSP ADMX_AuditSettings and EventLogService,
Security audit events 1100/1102/1104/4688/4719/4906/4912, Get-WinEvent)
and the MS-GPAC specification. Not run on a live host.
WINDOWS AUDIT POLICY AND EVENT LOG SETTINGS
===========================================
Turn on the Windows Security events that detection depends on: Microsoft's
audit policy recommendations per subcategory, auditpol to read, set, back
up and restore the policy, command lines in event 4688, Security log size
and retention, and the events that show someone changed the policy or
cleared the log. Event IDs themselves: see the Windows Security Event IDs
sheet. Domain controllers: see also the Active Directory Defense sheet.
HOW THE POLICY IS APPLIED
-------------------------
Two layers. Use the advanced one (subcategories, 58 in the MS-GPAC
list), not the old basic categories:
GPO: Computer Configuration > Policies > Windows Settings >
Security Settings > Advanced Audit Policy Configuration
Local: secpol.msc, or auditpol.exe from an elevated prompt
Keep this Security Option Enabled (it is Enabled by default) so the
basic categories cannot override the subcategories:
Local Policies > Security Options > "Audit: Force audit policy
subcategory settings (Windows Vista or later) to override audit
policy category settings"
# The registry value behind it is SCENoApplyLegacyAuditPolicy.
# Event 4719 is logged whenever the audit policy of the computer changes.
# In a domain, set the policy in a GPO; auditpol is for checking a host
# and for machines outside the domain.
READ THE CURRENT POLICY
-----------------------
auditpol /get /category:* # every subcategory, effective
auditpol /get /category:* /r > ap.csv # same, as CSV (report format)
auditpol /get /subcategory:"Process Creation"
auditpol /list /subcategory:* /v # names + GUIDs on this host
auditpol /list /user /v # accounts with per-user policy
auditpol /get /option:CrashOnAuditFail
# Run elevated. Subcategory names follow the Windows display language;
# the GUIDs below are fixed, so scripts that use them work everywhere.
MICROSOFT RECOMMENDATIONS
-------------------------
From Microsoft's "Audit Policy Recommendations". DEFLT = Windows
default, CL = client, SV = server, BASE = baseline, STR = stronger.
S = success, F = failure, dc = domain controllers only, if = only when
that role or feature is used, off = not audited, - = blank in Microsoft's
table. Subcategories blank in every column are left out.
SUBCATEGORY DEFLT CL-BASE CL-STR SV-BASE SV-STR
Credential Validation off S S+F S+F S+F
Kerberos Authentication Service - - S+F - S+F
Kerberos Service Ticket Operations - - S+F - S+F
Other Account Logon Events - - S+F - S+F
Computer Account Management - S S+F S+Fdc S+F
Other Account Management Events - S S+F S+F S+F
Security Group Management - S S+F S+F S+F
User Account Management S S S+F S+F S+F
DPAPI Activity - - S+F - S+F
Process Creation - S S+F S S+F
Directory Service Access - - - Sdc+Fdc Sdc+Fdc
Directory Service Changes - - - Sdc+Fdc Sdc+Fdc
Account Lockout S - S - S
IPsec Main Mode - - Sif+Fif - Sif+Fif
Logoff S S S S S
Logon S+F S+F S+F S+F S+F
Network Policy Server S+F - - - -
Other Logon/Logoff Events - - - - S+F
Special Logon S S S+F S S+F
Audit Policy Change S S+F S+F S+F S+F
Authentication Policy Change S S S+F S S+F
MPSSVC Rule-Level Policy Change - - S - S
IPsec Driver - S+F S+F S+F S+F
Other System Events S+F - - - -
Security State Change S S+F S+F S+F S+F
Security System Extension - S+F S+F S+F S+F
System Integrity S+F S+F S+F S+F S+F
# Logon: Success and Failure by default since Windows 10 1809 (Success
# only before). Microsoft calls these a starting point: test the event
# volume before production, and add what your detections need.
APPLY THE SERVER BASELINE WITH AUDITPOL
---------------------------------------
# PowerShell, elevated. Names as on English Windows.
$sf = 'Credential Validation','Other Account Management Events',
'Security Group Management','User Account Management','Logon',
'Audit Policy Change','IPsec Driver','Security State Change',
'Security System Extension','System Integrity'
$s = 'Process Creation','Logoff','Special Logon',
'Authentication Policy Change','Computer Account Management'
foreach ($n in $sf) {
auditpol /set /subcategory:"$n" /success:enable /failure:enable }
foreach ($n in $s) { auditpol /set /subcategory:"$n" /success:enable }
# /success:enable alone leaves the Failure setting as it was.
# Domain controllers add (S+F): Directory Service Access, Directory
# Service Changes, Computer Account Management.
# By GUID (any language):
$g = '{0CCE922B-69AE-11D9-BED3-505054503030}' # Process Creation
auditpol /set /subcategory:$g /success:enable
SUBCATEGORY GUIDS
-----------------
From the MS-GPAC protocol specification (section 2.2.1.2).
{0CCE923F-69AE-11D9-BED3-505054503030} Credential Validation
{0CCE9242-69AE-11D9-BED3-505054503030} Kerberos Authentication Service
{0CCE9240-69AE-11D9-BED3-505054503030} Kerberos Service Ticket Operations
{0CCE9241-69AE-11D9-BED3-505054503030} Other Account Logon Events
{0CCE9236-69AE-11D9-BED3-505054503030} Computer Account Management
{0CCE923A-69AE-11D9-BED3-505054503030} Other Account Management Events
{0CCE9237-69AE-11D9-BED3-505054503030} Security Group Management
{0CCE9235-69AE-11D9-BED3-505054503030} User Account Management
{0CCE922D-69AE-11D9-BED3-505054503030} DPAPI Activity
{0CCE922B-69AE-11D9-BED3-505054503030} Process Creation
{0CCE923B-69AE-11D9-BED3-505054503030} Directory Service Access
{0CCE923C-69AE-11D9-BED3-505054503030} Directory Service Changes
{0CCE9217-69AE-11D9-BED3-505054503030} Account Lockout
{0CCE9218-69AE-11D9-BED3-505054503030} IPsec Main Mode
{0CCE9216-69AE-11D9-BED3-505054503030} Logoff
{0CCE9215-69AE-11D9-BED3-505054503030} Logon
{0CCE9243-69AE-11D9-BED3-505054503030} Network Policy Server
{0CCE921C-69AE-11D9-BED3-505054503030} Other Logon/Logoff Events
{0CCE921B-69AE-11D9-BED3-505054503030} Special Logon
{0CCE922F-69AE-11D9-BED3-505054503030} Audit Policy Change
{0CCE9230-69AE-11D9-BED3-505054503030} Authentication Policy Change
{0CCE9232-69AE-11D9-BED3-505054503030} MPSSVC Rule-Level Policy Change
{0CCE9213-69AE-11D9-BED3-505054503030} IPsec Driver
{0CCE9214-69AE-11D9-BED3-505054503030} Other System Events
{0CCE9210-69AE-11D9-BED3-505054503030} Security State Change
{0CCE9211-69AE-11D9-BED3-505054503030} Security System Extension
{0CCE9212-69AE-11D9-BED3-505054503030} System Integrity
BACK UP, RESTORE, RESET
-----------------------
auditpol /backup /file:C:\audit\auditpolicy.csv
auditpol /restore /file:C:\audit\auditpolicy.csv
# Backup holds the system policy, per-user policy and audit options.
auditpol /clear # disables ALL auditing + deletes per-user policy
# auditpol /clear /y skips the prompt. Treat either as a red flag when
# you see it in process creation events.
COMMAND LINES IN EVENT 4688
---------------------------
Needs Audit Process Creation (Success) AND this policy:
Computer Configuration > Administrative Templates > System >
Audit Process Creation > Include command line in process creation
events (Enabled)
Intune/MDM CSP:
./Device/Vendor/MSFT/Policy/Config/ADMX_AuditSettings/IncludeCmdLine
Registry value the policy writes (check it, set it through policy):
$k = 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit'
Get-ItemProperty $k -Name ProcessCreationIncludeCmdLine_Enabled
# Anyone who can read the Security log can then read every command
# line, including passwords typed as arguments: restrict log access.
SECURITY LOG SIZE AND RETENTION
-------------------------------
wevtutil gl Security # enabled, retention, maxSize (bytes), file
wevtutil gli Security # record count, file size, last write
wevtutil sl Security /ms:1073741824 # 1 GB; size is in BYTES
Group Policy (sizes in KB):
Administrative Templates > Windows Components > Event Log Service >
Security > Specify the maximum log file size (KB)
# Security log: default 20 MB; policy range 20 MB to 2 TB.
# Size it so the log covers your investigation window between SIEM
# collections; check the oldest event date after a busy day.
Retention when full:
wevtutil sl Security /rt:false # new events overwrite the oldest
wevtutil sl Security /rt:true # keep old events, drop new ones
wevtutil sl Security /rt:true /ab:true # archive the full log, start
# a new one (needs disk space)
# Policy "Control Event Log behavior when the log file reaches its
# maximum size" Enabled = new events are not written and are lost.
EVENTS THAT SHOW TAMPERING
--------------------------
1102 The audit log was cleared Security
1104 The security log is now full Security
1100 The event logging service has shut down Security
4719 System audit policy was changed Security
4906 The CrashOnAuditFail value has changed Security
4912 Per User Audit Policy was changed Security
4688 process creation: watch auditpol.exe /clear or /set ... /success:
disable /failure:disable, and wevtutil cl / sl
# 4719, 4906 and 4912 are always logged, whatever the Audit Policy
# Change setting is.
CHECK THAT IT WORKS
-------------------
wevtutil qe Security /q:"*[System[(EventID=4688)]]" /c:3 /rd:true /f:text
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4719} -MaxEvents 5
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -MaxEvents 1 |
Format-List TimeCreated, Message # Process Command Line filled in?
# The Process Command Line field is empty until the policy above is on.
The recommendation table, subcategory GUIDs, auditpol and wevtutil syntax,
Group Policy paths, the CSP path, the registry value name, log size ranges
and event titles were checked against Microsoft Learn (Audit Policy
Recommendations, auditpol and wevtutil command references, command line
process auditing, Policy CSP ADMX_AuditSettings and EventLogService,
Security audit events 1100/1102/1104/4688/4719/4906/4912, Get-WinEvent)
and the MS-GPAC specification. Not run on a live host.
Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.