20411B-ENU-TrainerHandbook

Notice that most major Active Directory events are already audited by domain controllers, assuming thatPROHIBITED the events are successful. Therefore, the creation of a user, the resetting of a user’s password, the logon to

failed account logon events, you can expose malicious attempts to access the domain by repeatedly trying to log on as a domain user account without yet knowing the account’s password. Auditing failed account

Auditing entries directs Windows operating systems to audit the successful or failed activities of a security principal (user, group, or computer) to use a specific permission. Full Control includes all individual access levels, so this entry covers any type of access. For example, if you assign Full Control to the Consultant group, and if a Consultant group member attempts access of any kind and fails, this activity will be logged.

Because that access will be successful, the activity is not logged. Therefore, if you are concerned about restricting folder access and ensuring that users do not access it in any way, you should monitor failed access attempts. However, you should also audit successful access to identify situations in which a user is accessing the folder through another group membership that is potentially incorrect.

You can define the policy then to audit Success events, Failure events, or both. The policy setting must specify auditing of Success or Failure attempts that match the type of auditing entry in the object’s SACL. For example, to log a failed attempt by Consultants to access the Confidential Data folder, you must configure the Audit object access policy to audit failures, and you must configure the SACL of the Confidential Data folder to audit failures. If the audit policy audits successes only, the failure entries in the folder’s SACL will not trigger logging.

In Group Policy Management in AD DS, there is a group of standard settings in a GPO that control audit behavior. This set of audit policy settings is found under Computer Configuration, in the following node:

Windows Settings\Security\Local Policies\Audit Policy. The audit policy settings govern the following basic settings:

PROHIBITED

•Audit account logon events

•Audit account management

•A group administrator who has modified settings or data on servers that contain finance information.

•An employee within a defined group who has accessed an important file. USE

•That the correct SACL is applied to every file and folder or registry key on a computer or file share, as a verifiable safeguard against undetected access.

Understanding Advanced Audit Policy Settings

•Account Logon. These settings enable auditing the validation of credentials, and other Kerberos- ONLY specific authentication and ticket operation events.

•Account Management. You can enable auditing for events relating to the modification of user

accounts, computer accounts, and groups with the Account Management group of settings. .

•Detailed Tracking. These settings control auditing of encryption events, Windows process creation and

•termination events, and remote procedure call (RPC) events. STUDENT DS Access. These audit settings involve access to Directory Services, including general access, changes,

and replication.

•Logon/Logoff. Standard logon and logoff events are audited by this group of settings. Other account specific activity, such as Internet Protocol security (IPsec), Network Policy Server, and other uncategorized logon and logoff events are also audited.

•Object Access. These settings enable auditing for any access to AD DS, registry, application, and file storage.

•Policy Change. When you configure these settings, internal changes to audit policy settings are audited.

•Privilege Use. Within the Windows environment, Windows Server 2012 audits attempts of privilege

use, when you configure these settings. USE

•System. System settings are used for auditing changes to the state of the security subsystem.

•Global Object Access Auditing. These settings are for controlling the SACL settings for all objects on one or more computers. When settings in this group are configured and applied with Group Policy,

SACL membership is determined by the configuration of the policy setting, and the SACLs are

configured directly on the server itself. You can configure SACLs for file system and registry access PROHIBITED under Global Object Access Auditing.

Administering Windows Server® 2012 11-13

complete the following steps:

1.On the host computer, click Start, point to Administrative Tools, and then click Hyper-V ManagerUSE.

2.In Hyper-V® Manager, click 20411B-LON-DC1, and in the Actions pane, click Start.

3.In the Actions pane, click Connect. Wait until the virtual machine starts.

4.Log on using the following credentials:

o User name: Adatum\Administrator PROHIBITED o Password: Pa$$w0rd

5.Perform steps 2 through 4 for 20411B-LON-CL1 and 20411B-LON-SVR1.

 Task 5: Use the recovery agent to open the file

1.On LON-DC1, browse to E:\Labfiles\Mod11\Mod11Share\Marketing.

2.Open DougFile.txt, modify the contents, and then save the file.

Your manager has asked you to track all access to file shares that are stored on LON-SVR1. You also need to be aware of any time a user accesses a file on a removable storage device that is attached to the server. You have decided to implement the appropriate object access settings by using Advanced audit policy Configuration.

STUDENT .ONLY

1.Create a Group Policy Object (GPO) for advanced auditing.

2.Verify audit entries.

 Task 1: Create a Group Policy Object (GPO) for advanced auditing

1.On LON-DC1, from Server Manager open Active Directory Users and Computers. USE

2.Create a new OU in Adatum.com named File Servers.

3.Move LON-SVR1 from the Computers container to the File Servers OU.

4.On LON-DC1, open Group Policy Management.

5.Create a new GPO called File Audit, and link it to the File Servers OU. PROHIBITED

6.Edit the File Audit GPO and under Computer Configuration, browse to the Advanced Audit Policy Configuration\Audit Policies\Object Access node.

7.Configure both the Audit Detailed File Share and Audit Removable Storage settings to record Success and Failure events.

8.Restart LON-SVR1 and log on as Adatum\Administrator with a password of Pa$$w0rd.