Audit Policy Guide

📜 Audit Policy Guide

WinSecHunter can only find what Windows actually recorded. This page maps the event catalog to Advanced Audit Policy subcategories, documents the built-in gap analyzer, and gives a readiness baseline.

← Home

---

1 · Check current state (60 seconds)

# Gaps that matter for a brute-force + RDP investigation, local host:
Test-WinSecAuditPolicy -Profile BruteForce, Rdp

# Fleet-wide (parallel over WinRM):
Test-WinSecAuditPolicy -ComputerName (Get-Content servers.txt) -Credential $cred

# Compliant rows too (audit trail / evidence of diligence):
Test-WinSecAuditPolicy -IncludeCompliant | Format-Table Computer, Subcategory, CurrentSetting, Severity

Each gap carries a ready-to-run fix:

Subcategory    : Logon
CurrentSetting : Success
RequiredSetting: Success and Failure
Severity       : Critical
AffectedEventIds: 4624, 4625
Recommendation : Events 4624,4625 are NOT audited (Failure missing). Fix:
                 auditpol /set /subcategory:"{0CCE9215-69AE-11D9-BED3-505054503030}" /success:enable /failure:enable

Note

Matching is by subcategory GUID, not display name — the analyzer works on non-English systems where auditpol localizes names.

2 · Requirement matrix

What WinSecHunter's hunt profiles need, and why:

Subcategory (GUID suffix)	Recommended	Enables	Why it matters for IP hunts
Logon …9215	Success + Failure	4624, 4625	the core signal: every logon + every failure with source IP and decoded SubStatus
Logoff …9216	Success	4634, 4647	session durations; abandoned sessions
Special Logon …921B	Success	4672	administrative token marker per session
Other Logon/Logoff …921C	Success + Failure	4648, 4649, 4778, 4779, 5632/5633	explicit-credential pivots, RDP reconnects, replay, wireless auth
Account Lockout …9217	Failure	4740 (+4625 substatus)	lockout names the trigger host — pivot gold
Credential Validation …923F	Success + Failure	4776	NTLM (VPN, IIS, shares) — often the only signal off the domain path
Kerberos Auth Service …9242	Success + Failure	4768, 4771	domain-level brute force with client IP (DCs)
Kerberos Service Ticket …9240	Success + Failure	4769, 4770	kerberoasting indicators (RC4 ticket encryption)
User Account Mgmt …9235	Success	4720–4726, 4738, 4794	attacker-created/backdoored accounts
Security Group Mgmt …9237	Success	4728, 4732, 4756	elevation into Administrators / Remote Desktop Users
Audit Policy Change …922F	Success + Failure	4719, 4715, 4907	attacker blinding you mid-incident
Authentication Policy Change …9230	Success	4713, 4739	Kerberos/trust tampering
Authorization Policy Change …9231	Success	4704, 4705	user-right grants (e.g. SeRemoteInteractiveLogonRight)
Process Creation …922B	Success	4688	IPs inside command lines (net use \\IP\share, PsExec, WinRM); also enable the "Include command line in process creation events" GPO
Sensitive Privilege Use …9228	Success + Failure	4672–4674	privileged operations during a session
File Share …9244	Failure (Success noisy)	5140, 5145	SMB lateral movement with source IP

Not subcategory-controlled (but WinSecHunter watches them)

Source	Events	Notes
Always recorded	1102 audit log cleared · 104 (System) log cleared	flagged Critical, T1070.001
Service Control Manager (System log)	7045 service installed	always on; catches PsExec-style remote services
RDP operational logs (RCM/LSM)	1149/1148, 21–25	enabled by default since Win8/2012; if absent → someone disabled the channels (investigate that)
Firewall operational log	2004–2006 rule changes	channel logging off by default: netsh advfirewall set allprofiles logging enable
WFP connection auditing	5156/5157	auditpol /set /subcategory:"Filtering Platform Connection" — very high volume; enable targeted
Sysmon	EID 1/3/8/10/13/16…	separate Sysinternals deployment; WinSecHunter auto-uses it, reports Skipped when absent

3 · Readiness baseline (copy-paste)

Servers & workstations:

auditpol /set /subcategory:"Logon" /success:enable /failure:enable
auditpol /set /subcategory:"Logoff" /success:enable
auditpol /set /subcategory:"Special Logon" /success:enable
auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable
auditpol /set /subcategory:"Account Lockout" /failure:enable
auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable
auditpol /set /subcategory:"User Account Management" /success:enable
auditpol /set /subcategory:"Security Group Management" /success:enable
auditpol /set /subcategory:"Audit Policy Change" /success:enable /failure:enable
auditpol /set /subcategory:"Process Creation" /success:enable
auditpol /set /subcategory:"Sensitive Privilege Use" /success:enable /failure:enable

Domain controllers additionally:

auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable
auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable

Prefer GPO? Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration — same subcategories, enforced fleet-wide. Then verify everywhere: Test-WinSecAuditPolicy -ComputerName $fleet -IncludeCompliant.

4 · Log sizing & retention

Auditing is worthless if the log wraps mid-incident:

Get-WinSecLogCoverage -CoveringFrom (Get-Date).AddDays(-14) |
    Where-Object Risk -in 'Medium','High','Critical' |
    Format-Table Computer, LogName, UsedPercent, OldestRecordUtc, Risk, Warning

• Default Security log = 20 MB — an RDP brute-force storm evicts a day of history in hours. Size critical tiers at 1–4 GB.
• wevtutil sl Security /ms:4294967296 or GPO Maximum Log Size.
• Consider retention mode Retain (archive when full) on crown-jewel hosts.
• Forward to WEC/SIEM for long-horizon storage — WinSecHunter complements retention, it doesn't replace it.

5 · Remote collection prerequisites

Sweeps need WinRM + rights on targets (full detail: Remote Collection):

Enable-PSRemoting -Force                        # one-time on each target
# dedicated IR service account → local Administrators or SeSecurityPrivilege

Test-WinSecAuditPolicy itself runs over the same transport and reports per-host errors (elevation, connectivity) instead of failing silently.

---

Localized Windows (2.1.0)

auditpol /get /subcategory:* /r writes a CSV whose header is localized. Since 2.1.0 the output is parsed by column position — machine, policy target, subcategory, subcategory GUID, inclusion setting, exclusion setting — so Russian, German or any other Windows display language no longer breaks the analysis.

auditpol still requires an elevated session; without it the cmdlet reports the policy as unavailable instead of throwing.

Next: Configuration → · Related: Problem Domain — evidence doctrine