Let's now move on to detecting threats or current operating systems come with pre-installed tools and
mechanisms that audit the activity of system users the Windows systems keep track of security related
events in the security log.
The security log is disabled by default in older versions of Windows.
This means that the log doesn't record any events until we enable it manually.
This has changed with the release of Windows 7.
Of course it's always been different for server systems.
What clusters of events can be found in a security log records are divided into several categories each
category record reports on whether a specific attack has been successful success or not failure.
Auditing Object Access is the first of these categories.
Enabling this value generates a significant increase in the number of security log entries.
Several hundred megabytes of audit data maybe usually generated for a day's work of a device.
For example for a PC or even for a network printer the object access category includes all operations
on objects an object can be a file or a folder or a printed document and attempt to read a file will
also be logged.
The second category is directory service access.
Once this is enabled the security log will record all successful or failed attempts to read modify data
stored in the Active Directory database.
Third is auditing process tracking which is usually disabled when this category is set to auditing each
operation will come up in the log multiple times.
As far as security is concerned this level of specificity is not required.
Enabling privilege use audit is crucially important though all instances of a user exercising or attempting
to exercise user rights will be logged.
Which means for example that when an administrator takes over a file or folder this event will be reported
in the log.
If we truly prioritize security auditing account management is another category which should be enabled
in all environments.
Once this value is checked the log will record all events relating to creating modifying and deleting
user accounts and user groups.
On events are usually only monitored in critical servers.
In most cases log on to workstations are not hugely relevant.
However a user stopping or server especially an active directory server is a significant event and should
be recorded into the log.
System Events sadit is disabled by default for most systems except for the most crucial servers.
Policy change on the other hand is an audit category that should always be kept enabled.
Only once it's enabled will we know if a change to our security policy configurations has been made
or has been attempted.
After enabling object access auditing we need to determine the types of objects to which the audit will
apply.
It's necessary also to specify the users that are to be monitored in this way in older versions of Windows.
This is done per object usually per folder.
You can see an example in the picture below.
In newer Windows systems this audit can be enabled globally.