10.5. Summary

Auditing enables you to monitor events associated with specific users, groups, and services. These events are recorded to the security log. The capability to monitor these events is not only useful for troubleshooting, but also is an important tool for monitoring and managing security. You learned how you can keep tabs on the actions of specific users or groups and monitor attempts at unauthorized access to the system or its resources.

As the chapter explained, configuring auditing for most types of events is a one-step process. You configure the policy for Success, Failure, or both in the local or group security policy. Configuring the auditing of object access, such as monitoring access to folders/files, printers, or the registry, requires the additional step of configuring auditing on each object to be monitored.