2

I want to audit registry related events (modify key delete key etc) , so i enabled it via group policy and setup a "Global Object Access Auditing" for auditing on "Authenticated Users". Unfortunately the event count it too high and almost 95% of them are from "NT SYSTEM". Below are my questions;

-> Why is "NT SYSTEM" part of "Authenticated Users"? -> What should i select in the "Global Object Access Auditing", which limits auditing to all interactive and non interactive users except SYSTEM.?

Edit: If i were to use, "Domain Users" i need to create seperate entry for each domain in the forest and out fo forest; i am wishing, it were to be last resort move.

3
  • 2
    What is a GACL?
    – Ryan Ries
    Jun 15, 2016 at 2:17
  • 2
    @RyanRies A GACL of geese, of course.
    – MDMarra
    Jun 15, 2016 at 2:34
  • My bad , Replaced Gacl with "Global Object Access Auditing".
    – Darktux
    Jun 15, 2016 at 14:24

1 Answer 1

0

Authenticated users is not a group that contains members. It's a condition.

Set it to Domain Users.

2
  • Should i be creating seperate entry for all the domains in the forest? and same with the out of forest domains?
    – Darktux
    Jun 15, 2016 at 14:25
  • This is a vital bit of information that wasn't in our question prior to your edit. You could get around this by creating a universal security group in your forest root domain and making Domain Users from each child domain a member.
    – Matt
    Jun 15, 2016 at 22:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .