Video Screencast Help
Give us your opinion and win with Symantec! Please help us by taking this survey to tell us about your experience with Symantec Connect, so that we can continue to grow and improve.  Take the survey.

Monitor Pack (MS6) - Windows - Monitor Audit Policy

Created: 22 May 2009
Antonp's picture
0 0 Votes
Login to vote

Monitor pack for monitor Solution 6 (conversion to monitor Solution 7 in progress)

It is very important to monitor the Audit policy in order to prevent a rogue administrator from turning auditing off, performing a forbidden action, and turning auditing back on.
You would be monitoring the following events for changes to your Audit Policy:

  • 608 User Right Assigned
  • 609 User Right Removed
  • 610 New Trusted Domain
  • 611 Removing Trusted Domain
  • 612 Audit Policy Change