Video Screencast Help

Monitor Pack (MS6) - Windows - Monitor Audit Policy

Created: 22 May 2009
Antonp's picture
0 0 Votes
Login to vote

Monitor pack for monitor Solution 6 (conversion to monitor Solution 7 in progress)

It is very important to monitor the Audit policy in order to prevent a rogue administrator from turning auditing off, performing a forbidden action, and turning auditing back on.
You would be monitoring the following events for changes to your Audit Policy:

  • 608 User Right Assigned
  • 609 User Right Removed
  • 610 New Trusted Domain
  • 611 Removing Trusted Domain
  • 612 Audit Policy Change