Intune Security Policies – E2
After my first episode, I was busy working on different projects. Today, I decided to start with the security journey and recommendations. After “Administrative Templates Personalization," I realized I should discuss another security aspect: Audit. In Intune settings, there are 59 settings related to "Auditing," and in this blog, I selected some of the most important ones, which are also recommended by all Cyber Security and CIS Benchmark.
- Audit Process Creation(Enable): This policy setting determines what information is logged in security audit events when a new process is created. This setting only applies if the Audit Process Creation policy is enabled. When enabled, the command line information for every process will be logged in plain text within the security event log as part of the Audit Process Creation event 4688, ‘a new process has been created’ on the workstations and servers where this policy is applied. If this policy setting is disabled or not configured, the command line information will not be included in Audit Process Creation events. Default: Not configured. Note: When enabled, any user with access to read security events can view the command line arguments for any successfully created process. Command line arguments may contain sensitive or private information such as passwords or user data.
2. Account Logon Audit Credential Validation(Suceess+Failure): This setting allows you to monitor events generated by validation tests on user account logon credentials. These events occur only on the computer that is authoritative for those credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative.
3. Account Logon Logoff Audit Account Lockout (Failure): This policy setting enables you to track events caused by failed login attempts to a locked-out account. When you configure this policy, an audit event is created if an account cannot log in because it is locked out. Success audits log successful attempts, while failure audits record unsuccessful ones. Logon events are vital for monitoring user activity and identifying potential security threats.
4. Account Logon Logoff Audit Group Membership (Success): This policy allows you to audit group membership information in the user's logon token. Events in this category are generated on the computer where a logon session is established. For an interactive logon, the security audit event is created on the computer the user logs into. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. When this setting is enabled, one or more security audit events are produced for each successful logon. You also need to enable the Audit Logon setting under Advanced Audit Policy Configuration"), System Audit Policies"), Logon/Logoff. Multiple events are generated if the group membership information does not fit into a single security audit event.
5. Account Management Audit Application Group Management(Suceess+Failure): This policy setting allows you to audit events related to changes in application groups, such as creating, modifying, or deleting an application group. It also tracks when members are added or removed from an application group. If you enable this policy setting, an audit event will be generated whenever there is an attempt to change an application group. Successful attempts are recorded as success audits, while unsuccessful attempts are recorded as failure audits. If you do not enable this policy setting, no audit events will be generated when an application group is modified.
6. Audit Authentication Policy Change(Success): This policy setting enables you to audit events caused by changes to the authentication policy, such as the following: creation of forest and domain trusts, modification of these trusts, or removal of them. It also includes changes to the Kerberos policy under Computer Configuration. For example, when a new Trust has the same name as an existing namespace name. If you configure this policy setting, an audit event is generated when there is an attempt to change the authentication policy. Success audits record successful attempts, and failure audits record unsuccessful ones. If you do not configure this policy setting, no audit event is created when the authentication policy changes. Note: The security audit event is logged when the group policy is applied, not at the time when the settings are modified.
7. Audit File Share Access (Suceess+Failure): This policy setting enables you to audit attempts to access a shared folder. When you configure this setting, an audit event is created whenever there is an attempt to access a shared folder. If enabled, the administrator can choose to audit only successful attempts, only failed attempts, or both. Note: Shared folders do not have system access control lists (SACLs). When this setting is enabled, access to all shared folders on the system is audited.
8. Audit Special Logon(Success): This policy setting allows you to audit events generated by special logons, such as the following: A special logon is a logon that has administrator like privileges and can be used to elevate a process to a higher level. It also includes a logon by a member of a Special Group. Special Groups let you audit events when a member of a specific group logs into your network. You can set up a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event will be logged.
9. Object Access Audit Removable Storage (Suceess+Failure): this policy setting enables you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated for all objects and all types of access requested. When you configure this policy setting, an audit event occurs each time an account accesses a file system object on a removable storage device. Success audits record successful attempts, while Failure audits record unsuccessful ones. If you do not configure this policy setting, no audit events are generated when an account accesses a file system object on a removable storage device.
10. System Audit Other System Events (Suceess+Failure): This policy setting allows you to audit any of these events: startup and shutdown of the Windows Firewall service and driver, security policy processing by the Windows Firewall Service, and cryptography key file and migration operations.
Thanks for the reading.
.png)
Comments