Detections
Analytics

1.97 WN10-AU-000585

Information

Windows 10 must have command line process auditing events enabled for failures.

GROUP ID: V-257589RULE ID: SV-257589r958412

When this policy setting is enabled, the operating system generates audit events when a process fails to start and the name of the program or user that created it.

These audit events can assist in understanding how a computer is being used and tracking user activity.

Solution

Go to

Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >>System Audit Policies >> Detailed Tracking >> Audit Process Creation is set to 'failure'

.

See Also

https://workbench.cisecurity.org/benchmarks/23869

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(9), CCI|CCI-002234, Rule-ID|SV-257589r958412_rule, STIG-ID|WN10-AU-000585, Vuln-ID|V-257589

Plugin: Windows

Control ID: 91195337841539856b81f70ca785f29c0e008a754ef8b3113f5152353b1b0954