Auditing Improvements

  • Article

Big improvements from 2003 to 2008 in the level of granularity and also the detail. For example, audit logs can tell old and new values now.

To view list of Audit categories: “auditpol /list /subcategory:* ”

To view the current configuration: “auditpol /get /category:* ”

Subcategory Descriptions: https://support.microsoft.com/kb/947226

Win 2k8 has Last Interactive Logon tracking where a user can be presented with information about attempts to use their account: Group Policy.

Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Logon Options >Display Information About Previous Logons during user Logon.

Attributes to support this are: msDS-LastSuccessfulINteractiveLgonTime, msDS-LastFailedINteractiveLogonTime, msDS-FailedInteractiveLogonCount (since feature enabled), msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon.