Securing Windows Server 2003 tasks
Cisco TMS Secure Server Configuration Guide 13.0
Page 21 of 34
Table 6 Summary of audit policy settings
Policy
Security
Setting
Audit account logon
events
Success, Failure The ‘Audit account logon events’ policy determines
whether to log authentication of local users. Both
security settings should be logged.
Audit account
management
Success, Failure The ‘Audit account management’ policy determines
whether to log the creation, modification and deleting of
accounts. To determine who creates, modifies and
deletes accounts as well as to monitor failed attempts
that could indicate an attack. Log both security settings.
Audit directory service
access
Failure
The ‘Audit directory service access’ setting determines
whether to audit the event of a user accessing an Active
Directory object that has its own system access control
list (SACL) specified. Set to Failure.
Audit logon events
Success, Failure The ‘Audit logon events’ policy determines whether to
log local account activity. Log both success and failure.
Audit object access
Failure
The ‘Audit object access’ policy determines whether to
log events when a user accesses an object such as a
file, folder or registry key. Log only failures.
Audit policy change
Success
The ‘Audit policy change’ policy determines whether to
log changes to user rights assignment policies, trust
policies and audit policies. Log only successes.
Audit privilege use
Failure
The ‘Audit privilege use’ policy determines whether to
log use of a user right. Failures should be logged as a
failed privilege use can indicate an attempted security
breach.
Audit process tracking
No Auditing
The ‘Audit process tracking’ policy determines whether
to log detailed tracking information for events such as
program activation, process exit, handle duplication, and
indirect object access. As this would generate a large
number of events, the setting should be No auditing.
Audit system events
Success
The ‘Audit system events’ policy determines whether to
log events such as restarts and shutdown and events
affecting security. Log only success.
User rights assignment
User rights assignments provide users and groups with logon rights or privileges on the server. To
access the user rights assignment, go to Windows Start > Control Panel > Administrative Tools >
Local Security Policy> Local Policy > User Rights Assignment.
Table 7 List of recommended user rights settings
4
.
Policy
Security Setting
Access this computer from the
network (SeNetworkLogonRight)
Administrators, Authenticated Users, ENTERPRISE DOMAIN
CONTROLLERS, IUSR_<machinename>,
IWAM_<machinename>
4
See documentation from
Microsoft Support
and
Setting Up Windows Service Accounts
from Microsoft
Development for additional information on SQL service accounts.
