A. To enable auditing of base objects perform the following:
- Start the registry editor (regedit.exe)
- Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
- From the Edit menu select New - DWORD value. Enter a name of AuditBaseObjects. click OK
- Double click the new value and set to 1
You can also turn on full privilege auditing (but this will fill your event log):
- Start the registry editor (regedit.exe)
- Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
- From the Edit menu select New - DWORD value. Enter a name of FullPrivilegeAuditing. click OK
- Double click the new value and set to 1
0 comments
Hide comments