Video Screencast Help
As we strive to continually improve your experience on our site, please help us by taking this survey and tell us about your satisfaction level using Symantec Connect. One lucky winner will receive 500 Connect points! * Take the survey.

Monitor Pack (MS6) - Windows - Monitor Audit Policy

Created: 22 May 2009
Antonp's picture
0 0 Votes
Login to vote

Monitor pack for monitor Solution 6 (conversion to monitor Solution 7 in progress)

It is very important to monitor the Audit policy in order to prevent a rogue administrator from turning auditing off, performing a forbidden action, and turning auditing back on.
You would be monitoring the following events for changes to your Audit Policy:

  • 608 User Right Assigned
  • 609 User Right Removed
  • 610 New Trusted Domain
  • 611 Removing Trusted Domain
  • 612 Audit Policy Change