Detections
Analytics

2.2.23 (L1) Ensure 'Generate security audits' is set to 'LOCAL SERVICE, NETWORK SERVICE'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting determines which users or processes can generate audit records in the Security log.

The recommended state for this setting is: LOCAL SERVICE, NETWORK SERVICE

Note: This user right is considered a 'sensitive privilege' for the purposes of auditing.

An attacker could use this capability to create a large number of audited events, which would make it more difficult for a system administrator to locate any illicit activity. Also, if the event log is configured to overwrite events as needed, any evidence of unauthorized activities could be overwritten by a large number of unrelated events.

Solution

To establish the recommended configuration via GP, set the following UI path to LOCAL SERVICE, NETWORK SERVICE :

Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Generate security audits

Impact:

On most computers, this is the default configuration and there will be no negative impact. However, if you have installed

Web Server (IIS)

, you will need to allow the IIS application pool(s) to be granted this user right.

See Also

https://workbench.cisecurity.org/benchmarks/22007

Item Details

References: CSCv7|6.2

Plugin: Windows

Control ID: 963d3f0da75afca75608e4775aa9d55b95c95a625e11cc2f707924d9fab58e83