Windows NT includes auditing features you can use to collect information about how your system is being used. These features also allow you to monitor events related to system security, to identify any security breaches, and to determine the extent and location of any damage. The level of audited events is adjustable to suit the needs of your organization. Some organizations need little auditing information, whereas others would be willing to trade some performance and disk space for detailed information they could use to analyze their system.
Note
Remember that when you enable auditing, there is a small performance overhead for each audit check the system performs.
Windows NT can track events related to the operating system itself and to individual applications. Each application can define its own auditable events. Definitions of these events are added to the Registry when the application is installed on your Windows NT computer.
Audit events are identified to the system by the event source module name (which corresponds to a specific event type in the Registry) and an event ID.
In addition to listing events by event ID, the security log in Event Viewer lists them by category. The following categories of events are displayed in the Security Log. (Those in parentheses are found in the Audit Policy dialog box of User Manager.)
Category |
Meaning | |
Account Management (User and Group Management) | These events describe high-level changes to the user accounts database, such as User Created or Group Membership Change. Potentially, a more detailed, object-level audit is also performed (see Object Access events). | |
Detailed Tracking (Process Tracking) | These events provide detailed subject-tracking information. This includes information such as program activation, handle duplication, and indirect object access. | |
Logon/Logoff | These events describe a single logon or logoff attempt, whether successful or unsuccessful. Included in each logon description is an indication of what type of logon was requested or performed (that is, interactive, network, or service). | |
Object Access | These events describe both successful and unsuccessful accesses to protected objects. | |
Policy Change | These events describe high-level changes to the security policy database, such as assignment of privileges or logon capabilities. Potentially, a more detailed, object-level audit is also performed (see Object Access events). | |
Privilege Use | These events describe both successful and unsuccessful attempts to use privileges. It also includes information about when some special privileges are assigned. These special privileges are audited only at assignment time, not at time of use. | |
System Event (System) | These events indicate something affecting the security of the entire system or audit log occurred. | |
See "Security Event Examples" later in this chapter for examples of most of these event categories.