Auditing and Analyzing Access Control

On many computers, the state of the operating system changes frequently. If you, other administrators, or users periodically make changes to computer configurations, auditing and regular analysis will enable you to validate the security configuration on each computer and to verify that security has not been breached. For example, you might want to track who or what is attempting to perform certain tasks, or you might want to obtain information about why certain events are taking place or not taking place.

Windows XP Professional provides a number of auditing and analysis features including audit policies, Event Viewer, and the Security Configuration and Analysis snap-in that can aid you in effectively validating the security configurations on the computers in your organization.

Enabling Auditing Policies

You can monitor many different types of events on a Windows XP Professional based system, including user actions such as logging on and logging off, and the success and failure of key application events. Administrators need to monitor these events to track security, system performance, and application errors.

You can set up audit policies to track authorized and unauthorized access to resources. By default, auditing is not enabled. Before you enable auditing, it will be important for you to define exactly what needs to be audited and why you want it to be audited. Auditing can slow down system performance, and it will also require effort on your part to evaluate audit logs; therefore, advanced planning is recommended to ensure that you track appropriate system events without creating excess administrative overhead.

For example, if you decide to audit account logon sessions, you need to consider what the information will be used for. Your security administrators group might be interested in logging failed logon events because this can indicate that someone is trying to log on with an account for which he or she does not have the correct password. Alternatively, you might want to log successful logon attempts to determine whether users are accessing workstations in areas of the network that they are not permitted to use.

To enable auditing, use the Microsoft Management Console with the Group Policy snap-in focused on the local computer. To see the different types of objects for which auditing can be configured, navigate to the following folder: Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy.

There you will find a number of configuration audit policies, which can be used to audit events that fall into the following categories:

• Account logon events. Logs an event each time a user attempts to log on. For example, specific events logged include: logon failures for unknown user accounts; time restriction violations; user account has expired; user does not have the right to log on locally; account password has expired; account is locked out. Successful logons also can be tracked through events.

• Account management. Logs an event each time an account is managed. This is a useful function if you are concerned about changes being made to user accounts in your environment.

• Logon events. Logs an event for logon events that are occurring over the network or generated by service startup (such as an interactive logon events or service starting events).

• Object access. Logs an event each time a user attempts to access a resource such as a printer or shared folder.

• Policy changes. Logs an event each time a policy is successfully or unsuccessfully changed in your environment.

• Use of privileges. Logs an event each time a user attempts, successfully or unsuccessfully, to use special privileges, such as changing system time.

• Process tracking. Logs an event for each program or process that a user launches while accessing a system. Administrators can use this information to track the details of a user s activities while he or she is accessing a system.

• System events. Logs designated system events, such as when a user restarts or shuts down a computer.

For each of these categories, determine whether you want to log Success, Failure, or both Success and Failure for the events they represent. Then configure the object that you want to monitor so that the policy and the object are linked.

For example, to audit file and folder access, first mark the activities (Success, Failure, or both) that you want to track under Object Access. Then, for each of the files and folders that you want audited, configure the SACLs that enable auditing.

To enable auditing

1. Right-click the file or folder, and then click Properties.

2. On the Security tab, click the Advanced button.

3. On the Advanced Security Settings for Shared Documents page, click the Auditing tab.

   The Auditing tab is shown in Figure 16-9.

   
   Figure 16-9: Auditing tab

4. Click the Add button, and then select the users, or groups whose activity you want to monitor.

5. For each entry, determine whether you want to track successes or failures or both.

6. Determine whether auditing must be configured on this object only or other child objects. For example, if the object is a folder and you want to audit activity on files and subfolders, select Apply these auditing entries to objects and/or containers within this container only.

7. Configure settings for the Users, Computers, and Groups whose activities you want to track, complete the process by clicking OK.

8. In the Group Policy snap-in, navigate to:

   Local Computer Policy\Computer Configuration\Windows Settings \Security Settings\Local Policies\Audit Policy

9. Double-click Audit object access.

10. Select the appropriate check boxes for logging Success, Failure, or both.

11. Click OK.

The list of configurable entries is almost identical to the list of Access Control Entries for files and folders. For more information about ACEs for files and folders, see Access Control Entries earlier in this chapter.

Auditing the Use of Privileges

Windows XP Professional provides the option to audit the use of privileges. Although this setting can be either enabled or disabled, it cannot be applied selectively to individual rights.

Warning 

Auditing the use of user privileges generates a very large number of audits, and in most cases the value of the information this provides does not outweigh the associated management costs. Therefore, do not audit the use of user privileges unless it is strictly necessary for your environment. If you must audit the use of user privileges, it might be worthwhile to obtain or write an event-analysis tool that can gather information about only the user rights that are of interest to you.

Enabling the Use of Privileges category in the system s Audit policy does not enable the audit of all user rights. The following user rights are never audited:

• Bypass Traverse Checking (SeChangeNotifyPrivilege)

• Generate Security Audits (SeAuditPrivilege)

• Create A Token Object (SeCreateTokenPrivilege)

• Debug Programs (SeDebugPrivilege)

• Replace A Process Level Token (SeAssignPrimaryTokenPrivilege)

The following user rights are audited only if a specific registry entry is present:

• Backup Files and Directories (SeBackupPrivilege)

• Restore Files and Directories (SeRestorePrivilege)

You can enable auditing of these privileges by using the security policy user interface in Windows XP Professional.

Auditing Account Management

Account Management audit policy is very detailed in Windows 2000 and Windows XP Professional and in later service packs of Windows NT 4.0. Enabling auditing for this event category allows you to record the success or failure of the domain and local events that are listed with their event numbers in the Appendix Security Event Messages in this book.