Detections
Analytics

18.10.16.4 Ensure 'Enable OneSettings Auditing' is set to 'Enabled'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting controls whether Windows records attempts to connect with the OneSettings service to the Event Log.

The recommended state for this setting is: Enabled.

If events are not recorded it may be difficult or impossible to determine the root cause of system problems or the unauthorized activities of threat actors.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled :

Computer Configuration\Policies\Administrative Templates\Windows Components\Data Collection and Preview Builds\Enable OneSettings Auditing

Note: This Group Policy path may not exist by default. It is provided by the Group Policy template DataCollection.admx/adml that is included with the Microsoft Windows 11 Release 21H2 Administrative Templates (or newer).

Impact:

Windows will record attempts to connect with the OneSettings service to the Applications and Services Logs\Microsoft\Windows\Privacy-Auditing\Operational Event Log channel.

See Also

https://workbench.cisecurity.org/benchmarks/25708

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, CSCv7|8.5

Plugin: Windows

Control ID: dde31e800261fd6a5932a3d4bf73b59fd91d3bdd2835e21f7f81b0b578df61e9