MCSA/MCSE Self-Paced Training Kit (Exam 70-270): Installing ...

16-36 Chapter 16 Configuring Security Settings and Internet Options
Lesson 5: Implementing an Audit Policy
Auditing allows you to track both user activities and Windows XP Professional events
on a computer. Through auditing, you can specify that Windows XP Professional
records activities and events to a security log, which maintains a record of valid and
invalid logon attempts and events related to creating, opening, or deleting files or other
objects. An audit entry in the security log contains the following information:
■ The action that was performed
■ The user who performed the action
■ The success or failure of the event and when the event occurred
After this lesson, you will be able to
■ Describe the purpose of auditing.
■ Determine what you should audit.
■ Configure an audit policy.
■ Enable auditing for files and folder.
■ Enable auditing for printers.
Estimated lesson time: 60 minutes
Overview of Auditing
An audit policy defines the types of security events that Windows XP Professional
records in the security log on each computer. The security log allows you to track the
events that you specify.
Windows XP Professional writes events to the security log on the computer on which
the event occurs. For example, you can configure auditing so that anytime someone
tries to log on and the logon attempt fails, Windows XP Professional writes an event to
the security log on that computer.
You can set up an audit policy for a computer to do the following:
■ Track the success and failure of events, such as logon attempts by users, an
attempt by a particular user to read a specific file, changes to a user account or to
group memberships, and changes to your security settings
■ Eliminate or minimize the risk of unauthorized use of resources
You use Event Viewer to view events that Windows XP Professional has recorded in
the security log. You can also archive log files to track trends over time—for example,
to determine the use of printers or files or to verify attempts at unauthorized use of
resources. This lesson covers configuring an audit policy and enabling auditing of var-