I want to audit registry related events (modify key delete key etc) , so i enabled it via group policy and setup a "Global Object Access Auditing" for auditing on "Authenticated Users". Unfortunately the event count it too high and almost 95% of them are from "NT SYSTEM". Below are my questions;

-> Why is "NT SYSTEM" part of "Authenticated Users"? -> What should i select in the "Global Object Access Auditing", which limits auditing to all interactive and non interactive users except SYSTEM.?

Edit: If i were to use, "Domain Users" i need to create seperate entry for each domain in the forest and out fo forest; i am wishing, it were to be last resort move.

  • 2
    What is a GACL? – Ryan Ries Jun 15 '16 at 2:17
  • 2
    @RyanRies A GACL of geese, of course. – MDMarra Jun 15 '16 at 2:34
  • My bad , Replaced Gacl with "Global Object Access Auditing". – Darktux Jun 15 '16 at 14:24

Authenticated users is not a group that contains members. It's a condition.

Set it to Domain Users.

  • Should i be creating seperate entry for all the domains in the forest? and same with the out of forest domains? – Darktux Jun 15 '16 at 14:25
  • This is a vital bit of information that wasn't in our question prior to your edit. You could get around this by creating a universal security group in your forest root domain and making Domain Users from each child domain a member. – Matt Jun 15 '16 at 22:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.