Video Screencast Help
Symantec Secure Login will be live on Connect starting February 25. Get the details here.

Monitor Pack (MS7) - Windows - Monitor Audit Policy

Created: 27 May 2009 • Updated: 01 Jul 2009
Antonp's picture
0 0 Votes
Login to vote

Monitor pack for monitor Solution 7

It is very important to monitor the Audit policy in order to prevent a rogue administrator from turning auditing off, performing a forbidden action, and turning auditing back on.
You would be monitoring the following events for changes to your Audit Policy:

  • 608 User Right Assigned
  • 609 User Right Removed
  • 610 New Trusted Domain
  • 611 Removing Trusted Domain
  • 612 Audit Policy Change