-: In this short demonstration, I'm going to show you how
to configure auditing inside Windows,
as well as how to audit your files.
Let's jump in the environment and get started.
So now that we're in the lab environment,
let's take a look inside our local group policy editor.
Underneath the local computer policy,
and then underneath the computer configuration,
we have our Windows settings, our security settings,
and finally, our audit policy, as shown here.
Under your audit policy, you have several different events.
And this is going to allow you to decide what
is going to be audited and what isn't.
For example, do you want to audit your logon events?
Well, right now, there's no auditing enabled for that,
so if we double click that, we can then log
or audit the success and failures of those login attempts.
So I'm going to go ahead and apply that and hit Okay.
For example, you might want to audit our object access.
This'll be things like files and folders.
I'm going to go ahead and hit success and failure on this.
And if you're ever wondering what something does,
just click on the explanation and it will show you that.
We can do the same thing for auditing privileges.
Any time somebody logs in as an admin
or does a run-as as an admin.
So we can go ahead and do those auditing as well.
And you can do this for all sorts of different things
inside of your policies.
Now, in addition to that, we want to look
at how we can audit our files and the access to those.
So I'm going to show you that here
as I configure my share drive.
First, I'm going to go ahead and minimize
this global policy editor, and here you can see
under my C-drive, I have a share drive.
I'm going to right click on that folder and hit properties.
From here, we can click on the security tab,
and underneath the security tab, we're going to click
on the advance button.
From the advance button, we're going to click on auditing,
and this is where you can configure it
to audit the files and the folders.
So to add those auditing entries,
we're simply going to click the add button.
And just like permissions, this is going to inherit downward
throughout the rest of the folder structure.
Now, from here, you'd be able to change
what principle it is, so if I select a principle,
and let's say I am going to go ahead and make it the Jason.ADM
account, which is the account I'm on right now.
Or, I could put in some group policies,
however you want to set that up.
Now, any time that Jason.adm has a success,
that applies to this folder, subfolder, or files,
then we want to be able to log that and audit that,
and that's what we're going to be able to do right here.
And so next, we'll hit okay.
And now you can see that any time there's a success
that Jason.adm is logged into it, and does a read
or an execute, then this folder, subfolder,
any files underneath it, it is going to be logged.
This is going to tell me any time that happens.
That's the benefit of doing this logging
and this auditing.
So that's the basics of how to set up auditing
on a file or folder.
You can use this to be able to log any time a certain user
or a group of users logs in or touches some sort of files
or folders, whether they're reading it, executing it,
or modifying it.
Now, why would you use this?
Well, maybe you have some regulatory requirements.
Maybe you're a healthcare provider
and you fall under HIPA
and you need to know exactly who touches each
and every person's confidential health data.
And so if you have a nurse who logs in,
that would be able to keep track
that Nurse A has touched this file on this date
and this time.
And this is one of the ways you can use auditing.
Now, also, you can do this
if you have a suspected insider threat.
Maybe I really think Jason is a bad guy,
and so I want to see everything that Jason touches.
I can set up these audit trails to log
and alert every time Jason tries to touch something,
and that way, I can keep that information
and go back later and use it to build my case against him.
You can do a lot of different things with auditing,
but it is a mainstay of security,
and so you have to figure out exactly what you need
to audit, how much you need to audit,
and where you need to audit.
(electronic whirring)