I need to meet government security requirements in order to ship my product. Here is specific requirement I am trying to meet:
Group ID (Vulid): V-1080 Group
Title: File Auditing Configuration
Rule ID: SV-29471r1_rule
Severity: CAT II
Rule Version (STIG-ID): 2.007
Rule Title: File-auditing configuration does not meet minimum requirements.
Vulnerability Discussion: Improper modification of the core system files can render a system inoperable. Further, modifications to these system files can have a significant impact on the security configuration of the system. Auditing of significant modifications made to the system files provides a method of determining the responsible party.
False Positives: Automated checking sometimes reports this as a false finding. If a manual review of a questionable finding shows auditing to be set correctly, then this would not be a finding.
Responsibility: System Administrator IAControls: ECAR-1, ECAR-2, ECAR-3
Check Content: If system-level auditing is not enabled, or if the system and data partitions are not installed on NTFS partitions, then mark this as a finding.
Open Windows Explorer and use the file and folder properties function to verify that the audit settings on each partition/drive is configured to audit all "failures" for the "Everyone" group.
If any partition/drive is not configured to at least the minimum requirement, then this is a finding.
Fix Text: Configure auditing on each partition/drive to audit all "Failures" for the "Everyone" group.
I need to log Windows Vista file access failures using Windows file auditing for the entire local disk (C:). With a fresh install of Windows Vista Business SP2, I log in as a local admin. In Windows Explorer I select C:, Properties, Advanced, Auditing, Continue, Continue. Add an auditing entry for Everyone. Apply to 'This folder, subfolders and files'. Check 'Full Control' for Failed. Leave 'Apply these auditing entries to objects and/or containers within this container only' unchecked. OK, Apply.
After I click Apply, I get tens of 'Access is denied' error messages for various OS-related folders and files.
An error occurred while applying security information to:
File path
Access is denied.
or
An error occurred while applying security information to:
File path
The process cannot access the file because it is being used by another process.
I tried taking Ownership of C:, but I got errors when I tried to do that too. Is there a simple way to enable full Auditing for C: for Everyone either via batch script or via the Windows GUI without getting tens of error messages for OS controlled files and folders? If there is something that triggers 'Access is denied' can I just skip it rather than having to click 'OK' on an error popup?