Configure audit polices - Manual Process

1. Configure list of Windows workstations to be audited

1. Open Active Directory Users and Computers.
2. Right-click on the domain and select New > Group.
3. In the New object - Group window that opens, type in “ADAuditPlusWS” as the Group name, check Group scope: Domain Local and Group type: Security. Click OK.
4. Right-click the newly created group, then select Properties > Members > Add. Add all the Windows workstations that you want to audit as a member of this group. Click OK.

5. Using domain admin credentials, log in to any computer that has the Group Policy Management Console (GPMC) on it.

   Note: The GPMC will not be installed on workstations and/or enabled on member servers by default, so we recommend configuring audit policies on Windows domain controllers. Otherwise follow the steps in this page to install GPMC on your desired member server or workstation.

6. Go to Start > Windows Administrative Tools > Group Policy Management.
7. In the GPMC, right-click the domain in which you want to configure the Group Policy. Select Create a GPO and Link it here. In the New GPO window that opens, type in “ADAuditPlusWSPolicy” and click OK.
8. Select the <domain name>_ADAuditPlusWSPolicy GPO. Under Security Filtering, select Authenticated Users. Click Remove. In the Group Policy Management window that opens, select OK.
9. Select the <domain name>_ADAuditPlusWSPolicy GPO. Under Security Filtering, click Add and choose the security group ADAuditPlusWS created previously. Click OK.

2. Configure advanced audit policies

Configure the audit policies manually using the steps below:

1. Using domain admin credentials, log in to any computer that has the GPMC on it.
2. Go to Start > Windows Administrative Tools > Group Policy Management.
3. Right-click the GPO <domain name>_ADAuditPlusWSPolicy and select Edit.
4. In the Group Policy Management Editor, follow the steps below:

Note: Advanced audit policy configuration is only available in Windows Server 2008 or later. If you have an older version of Windows, configure legacy audit policies. It is recommended that you configure advanced audit policies instead of legacy audit policies to prevent storing needless event data logs, as the legacy policies contain more unwanted events.

1. Choose Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies.
2. Click, enable, and save the audit policies as shown below:

3. Force advanced audit policies

Force the advanced audit policies manually using the steps below:

1. Right-click the <domain name>_ADAuditPlusWSPolicy from GPMC.
2. In the Group Policy Management Editor, follow the steps below:
3. Choose Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options > Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings.
4. Enable the policy and click OK.

4. Configure legacy audit policies

Configure the legacy audit policies manually using the steps below:

1. Go to Start > Windows Administrative Tools > Group Policy Management.
2. Right-click the GPO <domain name>_ADAuditPlusWSPolicy and select Edit.
3. In the Group Policy Management Editor, follow the steps below:

Note:Advanced audit policy configuration is only available in Windows Server 2008 or later. If you have an older version of Windows, configure legacy audit policies. It is recommended that you configure advanced audit policies instead of legacy audit policies to prevent storing needless event data logs, as the legacy policies contain more unwanted events.

1. Choose Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Audit Policies.
2. Click, enable, and save the audit policies as shown below: