Detailed scan results: Analyzing security audit policy settings An important part of any security plan is the ability to monitor and audit events happening on your network. These event logs are frequently referenced in order to identify security holes or breaches. Identifying attempts and preventing them from becoming successful breaches of your system security is critical. In Windows, you can use ‘Group Policies’ to set up an audit policy that can track user activities or system events in specific logs. In order to help you keep track of your system’s auditing policy GFI LANguard N.S.S. collects the security audit policy settings from scanned target computers and includes in the scan results. This information is accessed by click on the Security Audit Policy sub-node. NOTE: GFI recommends that you set up the audit policy settings of your network computers as follows: Auditing Policy Success Failure Account logon events Yes Yes Account management Yes Yes Directory service access Yes Yes Logon events Yes Yes Object access Yes Yes Policy change Yes Yes Privilege use No No Process tracking No No System events Yes Yes Apart from gaining knowledge on the current audit policy settings, you can also use GFI LANguard N.S.S. 8 to access and modify the audit policy settings of your target computers. To achieve this: 1. From the ‘Scanned Computers’ (middle) pane, right-click on the respective target computer and select: • Enable auditing on > This computer to configure the audit policy settings of that particular computer. • Enable auditing on > Selected computers to configure the audit policy settings of multiple computers. • Enable auditing on > All computers to configure the audit policy settings of all scanned computers. Screenshot 39 - The audit policy administration wizard 2. Select/unselect the check boxes of the auditing policies that you wish to set up on the selected target(s). For example, to log successful events, select the ‘Successful’ check box of the relevant auditing policy. Click on Next to deploy the audit policy configuration settings on the target computer(s). Screenshot 40 - Results dialog in audit policy wizard 3. At this stage, a dialog will show whether the deployment of audit policy settings was successful or not. You can choose to re-deploy settings on failed computers by clicking on the Back button. To proceed to the next stage click Next. 4. Click Finish to finalize your settings and close the ‘Audit Policy Administration Wizard’.
