| Servers Enhanced Auditing Policy | |
| Data collected on: 7/27/2017 8:05:34 AM | |
| Domain | windomain.local | 
| Owner | WINDOMAIN\vagrant | 
| Created | 7/26/2017 8:25:20 PM | 
| Modified | 7/26/2017 8:25:22 PM | 
| User Revisions | 1 (AD), 1 (SYSVOL) | 
| Computer Revisions | 1 (AD), 1 (SYSVOL) | 
| Unique ID | {FEFE7A78-C5E6-4A09-A4E3-24590785DFFA} | 
| GPO Status | User settings disabled | 
| Location | Enforced | Link Status | Path | 
|---|---|---|---|
| Servers | Yes | Enabled | windomain.local/Servers | 
| Name | 
|---|
| NT AUTHORITY\Authenticated Users | 
| Name | Allowed Permissions | Inherited | 
|---|---|---|
| NT AUTHORITY\Authenticated Users | Read (from Security Filtering) | No | 
| NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS | Read | No | 
| NT AUTHORITY\SYSTEM | Edit settings, delete, modify security | No | 
| WINDOMAIN\Domain Admins | Edit settings, delete, modify security | No | 
| WINDOMAIN\Enterprise Admins | Edit settings, delete, modify security | No | 
| WINDOMAIN\vagrant | Edit settings, delete, modify security | No | 
| Policy | Setting | 
|---|---|
| Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings | Enabled | 
| Group | Members | Member of | 
|---|---|---|
| BUILTIN\Event Log Readers | NT AUTHORITY\NETWORK SERVICE | 
| Policy | Setting | 
|---|---|
| Policy version | 2.22 | 
| Disable stateful FTP | Not Configured | 
| Disable stateful PPTP | Not Configured | 
| IPsec exempt | Not Configured | 
| IPsec through NAT | Not Configured | 
| Preshared key encoding | Not Configured | 
| SA idle time | Not Configured | 
| Strong CRL check | Not Configured | 
| Name | Description | ||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Windows Remote Management (HTTP-In) | Inbound rule for Windows Remote Management via WS-Management. [TCP 5985] | ||||||||||||||||||||||||||||||||||||
| 
 | |||||||||||||||||||||||||||||||||||||
| Policy | Setting | 
|---|---|
| Audit Credential Validation | Success, Failure | 
| Audit Other Account Logon Events | Success, Failure | 
| Policy | Setting | 
|---|---|
| Audit Security Group Management | Success, Failure | 
| Audit User Account Management | Success, Failure | 
| Policy | Setting | 
|---|---|
| Audit DPAPI Activity | Success, Failure | 
| Audit PNP Activity | Success, Failure | 
| Audit Process Creation | Success, Failure | 
| Audit Process Termination | Success, Failure | 
| Policy | Setting | 
|---|---|
| Audit Account Lockout | Success, Failure | 
| Audit User / Device Claims | Success, Failure | 
| Audit Group Membership | Success, Failure | 
| Audit Logoff | Success, Failure | 
| Audit Logon | Success, Failure | 
| Audit Other Logon/Logoff Events | Success, Failure | 
| Audit Special Logon | Success, Failure | 
| Policy | Setting | 
|---|---|
| Audit Detailed File Share | Success, Failure | 
| Audit File Share | Success, Failure | 
| Audit File System | Success, Failure | 
| Audit Filtering Platform Connection | Failure | 
| Audit Other Object Access Events | Success, Failure | 
| Audit Registry | Success, Failure | 
| Audit Removable Storage | Success, Failure | 
| Policy | Setting | 
|---|---|
| Audit Audit Policy Change | Success, Failure | 
| Audit Authentication Policy Change | Success, Failure | 
| Audit MPSSVC Rule-Level Policy Change | Success, Failure | 
| Audit Other Policy Change Events | Success, Failure | 
| Policy | Setting | 
|---|---|
| Audit Non Sensitive Privilege Use | Failure | 
| Audit Sensitive Privilege Use | Success, Failure | 
| Policy | Setting | 
|---|---|
| Audit Other System Events | Success, Failure | 
| Audit Security State Change | Success, Failure | 
| Audit Security System Extension | Success, Failure | 
| Audit System Integrity | Success, Failure | 
| Policy | Setting | Comment | 
|---|---|---|
| Include command line in process creation events | Enabled | 
| Policy | Setting | Comment | ||
|---|---|---|---|---|
| Back up log automatically when full | Disabled | |||
| Control Event Log behavior when the log file reaches its maximum size | Disabled | |||
| Specify the maximum log file size (KB) | Enabled | |||
| 
 | ||||
| Policy | Setting | Comment | ||
|---|---|---|---|---|
| Back up log automatically when full | Disabled | |||
| Control Event Log behavior when the log file reaches its maximum size | Disabled | |||
| Specify the maximum log file size (KB) | Enabled | |||
| 
 | ||||
| Policy | Setting | Comment | ||
|---|---|---|---|---|
| Back up log automatically when full | Disabled | |||
| Control Event Log behavior when the log file reaches its maximum size | Disabled | |||
| Specify the maximum log file size (KB) | Enabled | |||
| 
 | ||||
| Policy | Setting | Comment | ||
|---|---|---|---|---|
| Turn on Script Execution | Enabled | |||
| 
 | ||||
| Policy | Setting | Comment | 
|---|---|---|
| Allow Remote Shell Access | Enabled | 
| Action | Update | 
| Hive | HKEY_LOCAL_MACHINE | 
| Key path | SYSTEM\CurrentControlSet\Control\Lsa | 
| Value name | RestrictRemoteSamEventThrottlingWindow | 
| Value type | REG_DWORD | 
| Value data | 0x0 (0) | 
| Stop processing items on this extension if an error occurs on this item | No | 
| Remove this item when it is no longer applied | No | 
| Apply once and do not reapply | No |