|
"Reason for access" settings
|
| bet | 89/104 | | Sana | 01.04.2021 | | Hajmi | 129,34 Kb. | | #13818 |
"Reason for access" settings
There are several events in Windows to audit whenever an operation was successful or unsuccessful. The events usually include the user, the object, and the operation, but they lack the reason why the operation was allowed or denied. Forensics analysis and support scenarios are improved in Windows Server 2008 R2 and Windows 7 by logging the reason, based on specific permissions, why someone had access to corporate resources.
In Windows Server 2008 R2 and Windows 7, enhanced audit policies can be configured and deployed by using domain Group Policy, which reduces management cost and overhead and significantly enhances the flexibility and effectiveness of security auditing.
The following sections describe the new events and event categories that are available in the Advanced Audit Policy Configuration node of Group Policy.
|
| |
