Enabling Security Auditing on Windows Home Server (part 2) - Understanding the Auditing Policies

2. Understanding the Auditing Policies

To help you decide which auditing policies to use, the next few sections give you a bit of detail about some of them. Note that several of these policies require AD to return meaningful or useful results. This means they don’t apply to Windows Home Server, so I don’t discuss them here.

Audit Account Logon Events

The Audit Account Logon Events policy enables you to track when users log on to their account on the Windows Home Server computer. If you track failures for this policy, the resulting Failure Audit event returns an Error Code value, as shown in Figure 2. Table 1 tells you what the various error codes mean.

Figure 2. An example of a failed Account Logon event.

Audit Account Management

The Audit Account Management policy enables you to track events related to managing groups and user accounts on Windows Home Server. Events include creating new groups or users, modifying or deleting groups or users, changing user passwords, or renaming or disabling users. Table 2 lists the possible event IDs for the Audit Account Management category.

Figure 3 shows a sample event that occurred when a user’s account was disabled (event ID 4725).

Figure 3. An example of an Account Management event.

Audit Logon Events

The Audit Logon Events policy enables you to track when users log on to the Windows Home Server network. These events always occur in conjunction with Account Logon events. That is, first Windows Home Server processes the logon to the user’s account on the server; then it processes the logon to the network. Table 3 lists the possible event IDs for the Audit Logon Events category.

If you’re auditing failures for this category, each Failure Audit event tells you the reason for the failure, as shown in Figure 4.

Figure 4. An example of a failed Logon event.

Audit Policy Change

The Audit Policy Change policy enables you to track when users make changes to group policies. The resulting event shows you what policy was changed and what the new policy setting is. For example, Figure 5 shows an event generated by modifying the auditing policies.

Figure 5. An example of a Policy Change event.

Audit Process Tracking

The Audit Process Tracking policy enables you to track the starting and stopping of processes, including programs. For example, you might want to track when scripts run on the server. Most scripts are handled by wscript.exe, so the program runs each time a script is launched. Figure 6 shows an example event created when a script starts.

Figure 6. An example of an Audit Process Tracking event.

Audit System Events

The Audit System Events policy enables you to track system events such as shutdown and startup, security changes, and system time changes. Figure 7 shows an example event, and Table 4 lists the possible event IDs.

Figure 7. An example of a System event.