MigrationBot: Backfill (v3.0 review queue): added to the review queue

2026-09-22T05:42:58Z

Backfill (v3.0 review queue): added to the review queue

← Older revision		Revision as of 05:42, 22 September 2026
Line 49:		Line 49:
	[[Category:Windows System Auditing\|007]]		[[Category:Windows System Auditing\|007]]
	[[Category:Migrated from cypat.guide]]		[[Category:Migrated from cypat.guide]]
			[[Category:Pending review]]

MigrationBot: Import from cypat.guide: docs/windows/system_auditing/system_auditing_beginner.md

2026-09-18T17:06:46Z

Import from cypat.guide: docs/windows/system_auditing/system_auditing_beginner.md

New page

{{Submit}}

-----

Author(s): LOWERCASEinuppercase

Last Updated: 06-10-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

* None

|}

== What Is Auditing? ==

System auditing is the process of tracking and logging certain events on a system. This can include things like login and logoff, attempting to access a certain file or folder, or modifying system settings. These logs can help system administrators identify suspicious activity or system issues. In Windows, system auditing is configured through the '''Audit Policy''' settings, which logs selected events to the '''Event Log'''.

When deciding audit policies, it's important to consider what might be beneficial to record, and adjust settings accordingly. For example, one use-case for auditing would be monitoring to see if anyone is attempting to access a user's account or brute-force their password. In that case, it may be useful to audit something like logon failures. In general it is considered best practice to audit as much as possible, though it's important to note that some policies will generate a lot of unnecessary diagnostic events that will quickly clog up the event log.

== Configuring Audit Policy ==

Audit policy on a system is typically configured through either basic audit policy or advanced audit policy. Both of these can be configured through the '''Local Security Policy''', also known as secpol.msc. To open Local Security Policy, go to the Windows search bar and type in either "local security policy" or "secpol.msc" and press enter. Let's take a look at how to configure audit policy in both ways.

=== Basic Audit Policy ===

Basic audit policy can be configured by navigating to <code>Local Policies > Audit Policy</code>. Listed here are 9 broad categories of events that the system can audit. By double-clicking any one of them, you can configure whether the system will audit success and/or failure events in each category.

=== Advanced Audit Policy ===

Advanced audit policy can be configured by navigating to the subcategories under <code>Advanced Audit Policy Configuration > System Audit Policies - Local Group Policy Object</code>. These subcategories are similar to the ones available with a basic audit policy, but they allow for more granularity with the available settings.

For example, under the <code>Logon/Logoff</code> category, there are multiple specific settings which can be individually configured. Setting <code>Audit account logon events</code> to a given option in the basic audit policy would be equivalent to applying that option to every subcategory under the <code>Logon/Logoff category</code> in the advanced audit policy. Using an advanced audit policy gives you the choice to have different settings between those subcategories.

=== Command Prompt ===

The audit policy can also be configured through the command prompt using the <code>auditpol.exe</code> command line utility (also just referred to as <code>auditpol</code>). First, open the command prompt by typing "cmd" into the Windows search bar. Now, in order to get all of the current system audit policies, enter <code>auditpol /get /category:*</code> at the prompt. This should display a list of auditing categories and subcategories (which should mirror those in the advanced audit policy) and their current settings. To enable auditing for one of these subcategories, you can run <code>auditpol /set /subcategory:"Subcategory Name Here" /success:enable /failure:enable</code>. To disable auditing for a subcategory, you can run the same command but replacing the <code>enable</code> with <code>disable</code> for the <code>/success</code> and <code>/failure</code> options.

-----

=== References & Further Reading ===

* https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq
* https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol

[[Category:Windows System Auditing|007]]
[[Category:Migrated from cypat.guide]]

Draft:System Auditing - Beginner - Revision history

MigrationBot: Backfill (v3.0 review queue): added to the review queue

MigrationBot: Import from cypat.guide: docs/windows/system_auditing/system_auditing_beginner.md