CSEC_PUBLIC/WELA
1
0 Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2026-10-04 21:44:43 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
dev
WELA/config/audit_profiles.json
T

5004 lines
157 KiB
JSON
Raw Permalink Blame History

{
"schemaVersion": 1,
"description": "Versioned advanced audit-policy profiles. Mask bits: success=1, failure=2. Omission and Not Configured preserve effective auditpol state; neither removes a GPO.",
"sources": {
"wela": {
"title": "WELA configure source, 2.2.0 development snapshot",
"version": "8ef938f0966e86adc527395f50f907c43e843d1e",
"url": "https://github.com/Yamato-Security/WELA/blob/8ef938f0966e86adc527395f50f907c43e843d1e/WELA.ps1#L1322"
},
"ms-defaults": {
"title": "Microsoft Advanced Audit Policy Configuration defaults (documentary reference)",
"version": "reviewed-2026-09-18",
"url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings"
},
"ms-audit": {
"title": "Microsoft Audit Policy Recommendations",
"version": "reviewed-2026-09-18",
"url": "https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations"
},
"ms-sct": {
"title": "Microsoft Security Compliance Toolkit Policy Analyzer files",
"version": "24H2 / 25H2 / Server 2022 / Server 2025 v2602",
"url": "https://www.microsoft.com/en-us/download/details.aspx?id=55319"
},
"ms-wef": {
"title": "Microsoft WEF intrusion detection, Appendix A minimum audit policy",
"version": "reviewed-2026-09-18",
"url": "https://learn.microsoft.com/en-us/windows/security/operating-system-security/device-management/use-windows-event-forwarding-to-assist-in-intrusion-detection#appendix-a---minimum-recommended-minimum-audit-policy"
},
"ms-identity": {
"title": "Microsoft Defender for Identity Windows event collection prerequisites",
"version": "reviewed-2026-09-18",
"url": "https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection"
},
"cis-client": {
"title": "CIS Microsoft Windows 11 Enterprise Benchmark",
"version": "4.0.0 (historical; not current CIS)",
"url": "https://rayasec.com/wp-content/uploads/CIS-Benchmark/Microsoft-Windows-Desktop/CIS_Microsoft_Windows_11_Enterprise_Benchmark_v4.0.0.pdf"
},
"cis-server": {
"title": "CIS Microsoft Windows Server 2022 Benchmark",
"version": "4.0.0 (historical; not current CIS)",
"url": "https://rayasec.com/wp-content/uploads/CIS-Benchmark/Microsoft-Windows-Server/CIS_Microsoft_Windows_Server_2022_Benchmark_v4.0.0.pdf"
},
"asd": {
"title": "ASD Windows event logging and forwarding (native fallback)",
"version": "2021-10-06",
"url": "https://www.cyber.gov.au/business-government/detecting-responding-to-threats/event-logging/windows-event-logging-and-forwarding"
}
},
"catalog": [
{
"id": "Credential Validation",
"guid": "0CCE923F-69AE-11D9-BED3-505054503030",
"category": "Account Logon",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Kerberos Authentication Service",
"guid": "0CCE9242-69AE-11D9-BED3-505054503030",
"category": "Account Logon",
"roles": [
"DomainController"
],
"prerequisites": ""
},
{
"id": "Kerberos Service Ticket Operations",
"guid": "0CCE9240-69AE-11D9-BED3-505054503030",
"category": "Account Logon",
"roles": [
"DomainController"
],
"prerequisites": ""
},
{
"id": "Other Account Logon Events",
"guid": "0CCE9241-69AE-11D9-BED3-505054503030",
"category": "Account Logon",
"roles": [
"DomainController"
],
"prerequisites": ""
},
{
"id": "Application Group Management",
"guid": "0CCE9239-69AE-11D9-BED3-505054503030",
"category": "Account Management",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": "Only generates application-group management evidence when the corresponding application-group activity occurs."
},
{
"id": "Computer Account Management",
"guid": "0CCE9236-69AE-11D9-BED3-505054503030",
"category": "Account Management",
"roles": [
"DomainController"
],
"prerequisites": ""
},
{
"id": "Distribution Group Management",
"guid": "0CCE9238-69AE-11D9-BED3-505054503030",
"category": "Account Management",
"roles": [
"DomainController"
],
"prerequisites": ""
},
{
"id": "Other Account Management Events",
"guid": "0CCE923A-69AE-11D9-BED3-505054503030",
"category": "Account Management",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Security Group Management",
"guid": "0CCE9237-69AE-11D9-BED3-505054503030",
"category": "Account Management",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "User Account Management",
"guid": "0CCE9235-69AE-11D9-BED3-505054503030",
"category": "Account Management",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "DPAPI Activity",
"guid": "0CCE922D-69AE-11D9-BED3-505054503030",
"category": "Detailed Tracking",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Plug and Play Events",
"guid": "0CCE9248-69AE-11D9-BED3-505054503030",
"category": "Detailed Tracking",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Process Creation",
"guid": "0CCE922B-69AE-11D9-BED3-505054503030",
"category": "Detailed Tracking",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": "Command-line payload requires ProcessCreationIncludeCmdLine_Enabled. This profile only configures audit policy."
},
{
"id": "Process Termination",
"guid": "0CCE922C-69AE-11D9-BED3-505054503030",
"category": "Detailed Tracking",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "RPC Events",
"guid": "0CCE922E-69AE-11D9-BED3-505054503030",
"category": "Detailed Tracking",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Token Right Adjusted Events",
"guid": "0CCE924A-69AE-11D9-BED3-505054503030",
"category": "Detailed Tracking",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Detailed Directory Service Replication",
"guid": "0CCE923E-69AE-11D9-BED3-505054503030",
"category": "DS Access",
"roles": [
"DomainController"
],
"prerequisites": ""
},
{
"id": "Directory Service Access",
"guid": "0CCE923B-69AE-11D9-BED3-505054503030",
"category": "DS Access",
"roles": [
"DomainController"
],
"prerequisites": "A matching AD object SACL is required. This profile does not create SACLs."
},
{
"id": "Directory Service Changes",
"guid": "0CCE923C-69AE-11D9-BED3-505054503030",
"category": "DS Access",
"roles": [
"DomainController"
],
"prerequisites": "A matching AD object SACL is required. This profile does not create SACLs."
},
{
"id": "Directory Service Replication",
"guid": "0CCE923D-69AE-11D9-BED3-505054503030",
"category": "DS Access",
"roles": [
"DomainController"
],
"prerequisites": ""
},
{
"id": "Account Lockout",
"guid": "0CCE9217-69AE-11D9-BED3-505054503030",
"category": "Logon/Logoff",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Group Membership",
"guid": "0CCE9249-69AE-11D9-BED3-505054503030",
"category": "Logon/Logoff",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "IPsec Extended Mode",
"guid": "0CCE921A-69AE-11D9-BED3-505054503030",
"category": "Logon/Logoff",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "IPsec Main Mode",
"guid": "0CCE9218-69AE-11D9-BED3-505054503030",
"category": "Logon/Logoff",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "IPsec Quick Mode",
"guid": "0CCE9219-69AE-11D9-BED3-505054503030",
"category": "Logon/Logoff",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Logoff",
"guid": "0CCE9216-69AE-11D9-BED3-505054503030",
"category": "Logon/Logoff",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Logon",
"guid": "0CCE9215-69AE-11D9-BED3-505054503030",
"category": "Logon/Logoff",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Network Policy Server",
"guid": "0CCE9243-69AE-11D9-BED3-505054503030",
"category": "Logon/Logoff",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Other Logon/Logoff Events",
"guid": "0CCE921C-69AE-11D9-BED3-505054503030",
"category": "Logon/Logoff",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Special Logon",
"guid": "0CCE921B-69AE-11D9-BED3-505054503030",
"category": "Logon/Logoff",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "User/Device Claims",
"guid": "0CCE9247-69AE-11D9-BED3-505054503030",
"category": "Logon/Logoff",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Application Generated",
"guid": "0CCE9222-69AE-11D9-BED3-505054503030",
"category": "Object Access",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Central Access Policy Staging",
"guid": "0CCE9246-69AE-11D9-BED3-505054503030",
"category": "Object Access",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Certification Services",
"guid": "0CCE9221-69AE-11D9-BED3-505054503030",
"category": "Object Access",
"roles": [
"ADCS"
],
"prerequisites": "The CA AuditFilter must also select the events. This profile does not configure AuditFilter."
},
{
"id": "Detailed File Share",
"guid": "0CCE9244-69AE-11D9-BED3-505054503030",
"category": "Object Access",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "File Share",
"guid": "0CCE9224-69AE-11D9-BED3-505054503030",
"category": "Object Access",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "File System",
"guid": "0CCE921D-69AE-11D9-BED3-505054503030",
"category": "Object Access",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": "A matching file/folder SACL is required. This profile does not create SACLs."
},
{
"id": "Filtering Platform Connection",
"guid": "0CCE9226-69AE-11D9-BED3-505054503030",
"category": "Object Access",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Filtering Platform Packet Drop",
"guid": "0CCE9225-69AE-11D9-BED3-505054503030",
"category": "Object Access",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Handle Manipulation",
"guid": "0CCE9223-69AE-11D9-BED3-505054503030",
"category": "Object Access",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": "A matching object SACL is required. This profile does not create SACLs."
},
{
"id": "Kernel Object",
"guid": "0CCE921F-69AE-11D9-BED3-505054503030",
"category": "Object Access",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": "Requires a matching target-object SACL and access rights/type. Enabling this audit policy does not install kernel-object SACLs or guarantee detection coverage."
},
{
"id": "Other Object Access Events",
"guid": "0CCE9227-69AE-11D9-BED3-505054503030",
"category": "Object Access",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Registry",
"guid": "0CCE921E-69AE-11D9-BED3-505054503030",
"category": "Object Access",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": "A matching registry SACL is required. This profile does not create SACLs."
},
{
"id": "Removable Storage",
"guid": "0CCE9245-69AE-11D9-BED3-505054503030",
"category": "Object Access",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "SAM",
"guid": "0CCE9220-69AE-11D9-BED3-505054503030",
"category": "Object Access",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Audit Policy Change",
"guid": "0CCE922F-69AE-11D9-BED3-505054503030",
"category": "Policy Change",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Authentication Policy Change",
"guid": "0CCE9230-69AE-11D9-BED3-505054503030",
"category": "Policy Change",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Authorization Policy Change",
"guid": "0CCE9231-69AE-11D9-BED3-505054503030",
"category": "Policy Change",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Filtering Platform Policy Change",
"guid": "0CCE9233-69AE-11D9-BED3-505054503030",
"category": "Policy Change",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "MPSSVC Rule-Level Policy Change",
"guid": "0CCE9232-69AE-11D9-BED3-505054503030",
"category": "Policy Change",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Other Policy Change Events",
"guid": "0CCE9234-69AE-11D9-BED3-505054503030",
"category": "Policy Change",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Non Sensitive Privilege Use",
"guid": "0CCE9229-69AE-11D9-BED3-505054503030",
"category": "Privilege Use",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Other Privilege Use Events",
"guid": "0CCE922A-69AE-11D9-BED3-505054503030",
"category": "Privilege Use",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Sensitive Privilege Use",
"guid": "0CCE9228-69AE-11D9-BED3-505054503030",
"category": "Privilege Use",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "IPsec Driver",
"guid": "0CCE9213-69AE-11D9-BED3-505054503030",
"category": "System",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Other System Events",
"guid": "0CCE9214-69AE-11D9-BED3-505054503030",
"category": "System",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Security State Change",
"guid": "0CCE9210-69AE-11D9-BED3-505054503030",
"category": "System",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "Security System Extension",
"guid": "0CCE9211-69AE-11D9-BED3-505054503030",
"category": "System",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
},
{
"id": "System Integrity",
"guid": "0CCE9212-69AE-11D9-BED3-505054503030",
"category": "System",
"roles": [
"Client",
"MemberServer",
"DomainController",
"ADCS"
],
"prerequisites": ""
}
],
"profiles": [
{
"id": "wela-2.2.0",
"version": "wela-2.2.0",
"sourceIds": [
"wela"
],
"omitted": "unchanged",
"scope": "advanced-audit-policy-only",
"appliesTo": [
{
"roles": [
"Client"
],
"minBuild": 22000,
"maxBuild": 26200
},
{
"roles": [
"MemberServer",
"DomainController",
"ADCS"
],
"minBuild": 20348,
"maxBuild": 26100
}
],
"controls": {
"Credential Validation": {
"mode": "exact",
"mask": 3
},
"Kerberos Authentication Service": {
"mode": "exact",
"mask": 3
},
"Kerberos Service Ticket Operations": {
"mode": "exact",
"mask": 3
},
"Computer Account Management": {
"mode": "exact",
"mask": 3
},
"Distribution Group Management": {
"mode": "exact",
"mask": 3
},
"Other Account Management Events": {
"mode": "exact",
"mask": 3
},
"Security Group Management": {
"mode": "exact",
"mask": 3
},
"User Account Management": {
"mode": "exact",
"mask": 3
},
"Plug and Play Events": {
"mode": "exact",
"mask": 3
},
"Process Creation": {
"mode": "exact",
"mask": 3
},
"Process Termination": {
"mode": "exact",
"mask": 3
},
"RPC Events": {
"mode": "exact",
"mask": 3
},
"Directory Service Access": {
"mode": "exact",
"mask": 3
},
"Directory Service Changes": {
"mode": "exact",
"mask": 3
},
"Account Lockout": {
"mode": "exact",
"mask": 3
},
"Logoff": {
"mode": "exact",
"mask": 3
},
"Logon": {
"mode": "exact",
"mask": 3
},
"Other Logon/Logoff Events": {
"mode": "exact",
"mask": 3
},
"Special Logon": {
"mode": "exact",
"mask": 3
},
"Certification Services": {
"mode": "exact",
"mask": 3
},
"File Share": {
"mode": "exact",
"mask": 3
},
"Detailed File Share": {
"mode": "exact",
"mask": 3
},
"Filtering Platform Connection": {
"mode": "exact",
"mask": 3
},
"Other Object Access Events": {
"mode": "exact",
"mask": 3
},
"Removable Storage": {
"mode": "exact",
"mask": 3
},
"SAM": {
"mode": "exact",
"mask": 3
},
"Audit Policy Change": {
"mode": "exact",
"mask": 3
},
"Authentication Policy Change": {
"mode": "exact",
"mask": 3
},
"Other Policy Change Events": {
"mode": "exact",
"mask": 3
},
"Sensitive Privilege Use": {
"mode": "exact",
"mask": 3
},
"Security State Change": {
"mode": "exact",
"mask": 3
},
"Security System Extension": {
"mode": "exact",
"mask": 3
},
"System Integrity": {
"mode": "exact",
"mask": 3
},
"Other System Events": {
"mode": "exact",
"mask": 3
},
"File System": {
"mode": "optional",
"mask": 3,
"note": "Opt-in subcategory prerequisite only. Use configure-sacl separately for targeted file/registry SACLs."
},
"Registry": {
"mode": "optional",
"mask": 3,
"note": "Opt-in subcategory prerequisite only. Use configure-sacl separately for targeted file/registry SACLs."
},
"Handle Manipulation": {
"mode": "optional",
"mask": 3,
"note": "Opt-in subcategory prerequisite only. Use configure-sacl separately for targeted file/registry SACLs."
},
"Group Membership": {
"mode": "exact",
"mask": 1,
"sourceIds": [
"ms-sct",
"cis-client",
"cis-server",
"asd"
],
"evidence": "CIS v4 17.5.2; Microsoft SCT; ASD native Group Membership Success."
},
"Application Group Management": {
"mode": "exact",
"mask": 3,
"sourceIds": [
"cis-client",
"cis-server"
],
"evidence": "CIS v4 17.2.1: Success and Failure."
},
"Authorization Policy Change": {
"mode": "exact",
"mask": 1,
"sourceIds": [
"cis-client",
"cis-server",
"ms-sct"
],
"evidence": "CIS v4 17.7.3 and Server 2025 SCT: Success. The separate WEF profile retains Success and Failure."
},
"MPSSVC Rule-Level Policy Change": {
"mode": "exact",
"mask": 3,
"sourceIds": [
"ms-sct",
"cis-client",
"cis-server",
"ms-wef"
],
"evidence": "CIS v4 17.7.4; Microsoft SCT and WEF: Success and Failure."
},
"IPsec Driver": {
"mode": "exact",
"mask": 3,
"sourceIds": [
"cis-client",
"cis-server",
"ms-audit"
],
"evidence": "CIS v4 17.9.1 and Microsoft generic audit recommendation: Success and Failure."
},
"Kernel Object": {
"mode": "exact",
"mask": 3,
"sourceIds": [
"asd"
],
"evidence": "ASD native audit policy: Success and Failure; matching object SACLs are a separate prerequisite."
}
},
"roleOverrides": {},
"note": "WELA native audit-policy profile: original configure controls plus six source-backed baseline gaps. Role-specific controls are not applied outside their roles. File/Registry/Handle optional policies and object SACL dependencies remain separate. Source profiles retain their own exact/minimum masks."
},
{
"id": "windows-defaults-reviewed-2026-09",
"version": "windows-defaults-reviewed-2026-09",
"sourceIds": [
"ms-defaults"
],
"omitted": "unchanged",
"scope": "advanced-audit-policy-only",
"appliesTo": [
{
"roles": [
"Client"
],
"minBuild": 22000,
"maxBuild": 26200
},
{
"roles": [
"MemberServer",
"DomainController",
"ADCS"
],
"minBuild": 20348,
"maxBuild": 26100
}
],
"controls": {},
"roleOverrides": {
"Client": {
"Credential Validation": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default on Server editions: Success ."
},
"Kerberos Authentication Service": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default on Server editions: Success ."
},
"Kerberos Service Ticket Operations": {
"mode": "exact",
"mask": 0,
"note": "Microsoft says Not configured; effective state modeled as no auditing, must validate."
},
"Other Account Logon Events": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Application Group Management": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Computer Account Management": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default on Server editions: Success ."
},
"Distribution Group Management": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Other Account Management Events": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Security Group Management": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success ."
},
"User Account Management": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success ."
},
"DPAPI Activity": {
"mode": "exact",
"mask": 0,
"note": "Modeled no-auditing starting point; verify effective auditpol on target image."
},
"Plug and Play Events": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Process Creation": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Process Termination": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"RPC Events": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Token Right Adjusted Events": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Detailed Directory Service Replication": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Directory Service Access": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default on Server editions: Success ."
},
"Directory Service Changes": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Directory Service Replication": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Account Lockout": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default setting: Success ."
},
"Group Membership": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"IPsec Extended Mode": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"IPsec Main Mode": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"IPsec Quick Mode": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Logoff": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success ."
},
"Logon": {
"mode": "exact",
"mask": 3,
"note": "Microsoft audit-policy-recommendations footnote: since Windows 10 1809, Logon defaults to Success and Failure. Older per-setting prose and WELA metadata disagree."
},
"Network Policy Server": {
"mode": "exact",
"mask": 3,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success and Failure ."
},
"Other Logon/Logoff Events": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Special Logon": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success"
},
"User/Device Claims": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Application Generated": {
"mode": "exact",
"mask": 0,
"note": "Modeled no-auditing starting point; verify effective auditpol on target image."
},
"Central Access Policy Staging": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Certification Services": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Detailed File Share": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"File Share": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"File System": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Filtering Platform Connection": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Filtering Platform Packet Drop": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Handle Manipulation": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Kernel Object": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Other Object Access Events": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Registry": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Removable Storage": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"SAM": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Audit Policy Change": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success ."
},
"Authentication Policy Change": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success ."
},
"Authorization Policy Change": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Filtering Platform Policy Change": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"MPSSVC Rule-Level Policy Change": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Other Policy Change Events": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Non Sensitive Privilege Use": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Other Privilege Use Events": {
"mode": "exact",
"mask": 0,
"note": "Modeled no-auditing starting point; verify effective auditpol on target image."
},
"Sensitive Privilege Use": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"IPsec Driver": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Other System Events": {
"mode": "exact",
"mask": 3,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success and Failure ."
},
"Security State Change": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success ."
},
"Security System Extension": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"System Integrity": {
"mode": "exact",
"mask": 3,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success and Failure ."
}
},
"MemberServer": {
"Credential Validation": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default on Server editions: Success ."
},
"Kerberos Authentication Service": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default on Server editions: Success ."
},
"Kerberos Service Ticket Operations": {
"mode": "exact",
"mask": 0,
"note": "Microsoft says Not configured; effective state modeled as no auditing, must validate."
},
"Other Account Logon Events": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Application Group Management": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Computer Account Management": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default on Server editions: Success ."
},
"Distribution Group Management": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Other Account Management Events": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Security Group Management": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success ."
},
"User Account Management": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success ."
},
"DPAPI Activity": {
"mode": "exact",
"mask": 0,
"note": "Modeled no-auditing starting point; verify effective auditpol on target image."
},
"Plug and Play Events": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Process Creation": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Process Termination": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"RPC Events": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Token Right Adjusted Events": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Detailed Directory Service Replication": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Directory Service Access": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default on Server editions: Success ."
},
"Directory Service Changes": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Directory Service Replication": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Account Lockout": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default setting: Success ."
},
"Group Membership": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"IPsec Extended Mode": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"IPsec Main Mode": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"IPsec Quick Mode": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Logoff": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success ."
},
"Logon": {
"mode": "exact",
"mask": 3,
"note": "Microsoft audit-policy-recommendations footnote: since Windows 10 1809, Logon defaults to Success and Failure. Older per-setting prose and WELA metadata disagree."
},
"Network Policy Server": {
"mode": "exact",
"mask": 3,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success and Failure ."
},
"Other Logon/Logoff Events": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Special Logon": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success"
},
"User/Device Claims": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Application Generated": {
"mode": "exact",
"mask": 0,
"note": "Modeled no-auditing starting point; verify effective auditpol on target image."
},
"Central Access Policy Staging": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Certification Services": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Detailed File Share": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"File Share": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"File System": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Filtering Platform Connection": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Filtering Platform Packet Drop": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Handle Manipulation": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Kernel Object": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Other Object Access Events": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Registry": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Removable Storage": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"SAM": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Audit Policy Change": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success ."
},
"Authentication Policy Change": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success ."
},
"Authorization Policy Change": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Filtering Platform Policy Change": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"MPSSVC Rule-Level Policy Change": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Other Policy Change Events": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Non Sensitive Privilege Use": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Other Privilege Use Events": {
"mode": "exact",
"mask": 0,
"note": "Modeled no-auditing starting point; verify effective auditpol on target image."
},
"Sensitive Privilege Use": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"IPsec Driver": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Other System Events": {
"mode": "exact",
"mask": 3,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success and Failure ."
},
"Security State Change": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success ."
},
"Security System Extension": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"System Integrity": {
"mode": "exact",
"mask": 3,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success and Failure ."
}
},
"DomainController": {
"Credential Validation": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default on Server editions: Success ."
},
"Kerberos Authentication Service": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default on Server editions: Success ."
},
"Kerberos Service Ticket Operations": {
"mode": "exact",
"mask": 0,
"note": "Microsoft says Not configured; effective state modeled as no auditing, must validate."
},
"Other Account Logon Events": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Application Group Management": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Computer Account Management": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default on Server editions: Success ."
},
"Distribution Group Management": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Other Account Management Events": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Security Group Management": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success ."
},
"User Account Management": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success ."
},
"DPAPI Activity": {
"mode": "exact",
"mask": 0,
"note": "Modeled no-auditing starting point; verify effective auditpol on target image."
},
"Plug and Play Events": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Process Creation": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Process Termination": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"RPC Events": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Token Right Adjusted Events": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Detailed Directory Service Replication": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Directory Service Access": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default on Server editions: Success ."
},
"Directory Service Changes": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Directory Service Replication": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Account Lockout": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default setting: Success ."
},
"Group Membership": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"IPsec Extended Mode": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"IPsec Main Mode": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"IPsec Quick Mode": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Logoff": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success ."
},
"Logon": {
"mode": "exact",
"mask": 3,
"note": "Microsoft audit-policy-recommendations footnote: since Windows 10 1809, Logon defaults to Success and Failure. Older per-setting prose and WELA metadata disagree."
},
"Network Policy Server": {
"mode": "exact",
"mask": 3,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success and Failure ."
},
"Other Logon/Logoff Events": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Special Logon": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success"
},
"User/Device Claims": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Application Generated": {
"mode": "exact",
"mask": 0,
"note": "Modeled no-auditing starting point; verify effective auditpol on target image."
},
"Central Access Policy Staging": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Certification Services": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Detailed File Share": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"File Share": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"File System": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Filtering Platform Connection": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Filtering Platform Packet Drop": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Handle Manipulation": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Kernel Object": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Other Object Access Events": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Registry": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Removable Storage": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"SAM": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Audit Policy Change": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success ."
},
"Authentication Policy Change": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success ."
},
"Authorization Policy Change": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Filtering Platform Policy Change": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"MPSSVC Rule-Level Policy Change": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Other Policy Change Events": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Non Sensitive Privilege Use": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Other Privilege Use Events": {
"mode": "exact",
"mask": 0,
"note": "Modeled no-auditing starting point; verify effective auditpol on target image."
},
"Sensitive Privilege Use": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"IPsec Driver": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Other System Events": {
"mode": "exact",
"mask": 3,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success and Failure ."
},
"Security State Change": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success ."
},
"Security System Extension": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"System Integrity": {
"mode": "exact",
"mask": 3,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success and Failure ."
}
},
"ADCS": {
"Credential Validation": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default on Server editions: Success ."
},
"Kerberos Authentication Service": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default on Server editions: Success ."
},
"Kerberos Service Ticket Operations": {
"mode": "exact",
"mask": 0,
"note": "Microsoft says Not configured; effective state modeled as no auditing, must validate."
},
"Other Account Logon Events": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Application Group Management": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Computer Account Management": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default on Server editions: Success ."
},
"Distribution Group Management": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Other Account Management Events": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Security Group Management": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success ."
},
"User Account Management": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success ."
},
"DPAPI Activity": {
"mode": "exact",
"mask": 0,
"note": "Modeled no-auditing starting point; verify effective auditpol on target image."
},
"Plug and Play Events": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Process Creation": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Process Termination": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"RPC Events": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Token Right Adjusted Events": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Detailed Directory Service Replication": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Directory Service Access": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default on Server editions: Success ."
},
"Directory Service Changes": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Directory Service Replication": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Account Lockout": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default setting: Success ."
},
"Group Membership": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"IPsec Extended Mode": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"IPsec Main Mode": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"IPsec Quick Mode": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Logoff": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success ."
},
"Logon": {
"mode": "exact",
"mask": 3,
"note": "Microsoft audit-policy-recommendations footnote: since Windows 10 1809, Logon defaults to Success and Failure. Older per-setting prose and WELA metadata disagree."
},
"Network Policy Server": {
"mode": "exact",
"mask": 3,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success and Failure ."
},
"Other Logon/Logoff Events": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Special Logon": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success"
},
"User/Device Claims": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Application Generated": {
"mode": "exact",
"mask": 0,
"note": "Modeled no-auditing starting point; verify effective auditpol on target image."
},
"Central Access Policy Staging": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Certification Services": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Detailed File Share": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"File Share": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"File System": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Filtering Platform Connection": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Filtering Platform Packet Drop": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Handle Manipulation": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Kernel Object": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Other Object Access Events": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Registry": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Removable Storage": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"SAM": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Audit Policy Change": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success ."
},
"Authentication Policy Change": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success ."
},
"Authorization Policy Change": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Filtering Platform Policy Change": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"MPSSVC Rule-Level Policy Change": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Other Policy Change Events": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Non Sensitive Privilege Use": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"Other Privilege Use Events": {
"mode": "exact",
"mask": 0,
"note": "Modeled no-auditing starting point; verify effective auditpol on target image."
},
"Sensitive Privilege Use": {
"mode": "exact",
"mask": 0,
"note": "WELA default metadata; cross-checked where Microsoft explicitly states a value; not measured."
},
"IPsec Driver": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"Other System Events": {
"mode": "exact",
"mask": 3,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success and Failure ."
},
"Security State Change": {
"mode": "exact",
"mask": 1,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success ."
},
"Security System Extension": {
"mode": "exact",
"mask": 0,
"note": "Microsoft Advanced Audit Policy Configuration: Default: No Auditing ."
},
"System Integrity": {
"mode": "exact",
"mask": 3,
"note": "Microsoft Advanced Audit Policy Configuration: Default: Success and Failure ."
}
}
},
"referenceOnly": true,
"note": "Documentary model, not an OS reset profile. Unconfigured policy and effective disabled state are not interchangeable; validate actual installation and domain GPO. Applying this reference is prohibited."
},
{
"id": "microsoft-sct-win11-24h2",
"version": "microsoft-sct-win11-24h2",
"sourceIds": [
"ms-sct"
],
"omitted": "unchanged",
"scope": "advanced-audit-policy-only",
"appliesTo": [
{
"roles": [
"Client"
],
"minBuild": 26100,
"maxBuild": 26100
}
],
"controls": {},
"roleOverrides": {
"Client": {
"Credential Validation": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows 11 24H2 - Computer"
},
"Security Group Management": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows 11 24H2 - Computer"
},
"User Account Management": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows 11 24H2 - Computer"
},
"Plug and Play Events": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows 11 24H2 - Computer"
},
"Process Creation": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows 11 24H2 - Computer"
},
"Account Lockout": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows 11 24H2 - Computer"
},
"Group Membership": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows 11 24H2 - Computer"
},
"Logon": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows 11 24H2 - Computer"
},
"Other Logon/Logoff Events": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows 11 24H2 - Computer"
},
"Special Logon": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows 11 24H2 - Computer"
},
"Detailed File Share": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows 11 24H2 - Computer"
},
"File Share": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows 11 24H2 - Computer"
},
"Other Object Access Events": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows 11 24H2 - Computer"
},
"Removable Storage": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows 11 24H2 - Computer"
},
"Audit Policy Change": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows 11 24H2 - Computer"
},
"Authentication Policy Change": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows 11 24H2 - Computer"
},
"MPSSVC Rule-Level Policy Change": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows 11 24H2 - Computer"
},
"Other Policy Change Events": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows 11 24H2 - Computer"
},
"Sensitive Privilege Use": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows 11 24H2 - Computer"
},
"Other System Events": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows 11 24H2 - Computer"
},
"Security State Change": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows 11 24H2 - Computer"
},
"Security System Extension": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows 11 24H2 - Computer"
},
"System Integrity": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows 11 24H2 - Computer"
}
}
}
},
{
"id": "microsoft-sct-win11-25h2",
"version": "microsoft-sct-win11-25h2",
"sourceIds": [
"ms-sct"
],
"omitted": "unchanged",
"scope": "advanced-audit-policy-only",
"appliesTo": [
{
"roles": [
"Client"
],
"minBuild": 26200,
"maxBuild": 26200
}
],
"controls": {},
"roleOverrides": {
"Client": {
"Credential Validation": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows 11 25H2 - Computer"
},
"Security Group Management": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows 11 25H2 - Computer"
},
"User Account Management": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows 11 25H2 - Computer"
},
"Plug and Play Events": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows 11 25H2 - Computer"
},
"Process Creation": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows 11 25H2 - Computer"
},
"Account Lockout": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows 11 25H2 - Computer"
},
"Group Membership": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows 11 25H2 - Computer"
},
"Logon": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows 11 25H2 - Computer"
},
"Other Logon/Logoff Events": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows 11 25H2 - Computer"
},
"Special Logon": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows 11 25H2 - Computer"
},
"Detailed File Share": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows 11 25H2 - Computer"
},
"File Share": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows 11 25H2 - Computer"
},
"Other Object Access Events": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows 11 25H2 - Computer"
},
"Removable Storage": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows 11 25H2 - Computer"
},
"Audit Policy Change": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows 11 25H2 - Computer"
},
"Authentication Policy Change": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows 11 25H2 - Computer"
},
"MPSSVC Rule-Level Policy Change": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows 11 25H2 - Computer"
},
"Other Policy Change Events": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows 11 25H2 - Computer"
},
"Sensitive Privilege Use": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows 11 25H2 - Computer"
},
"Other System Events": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows 11 25H2 - Computer"
},
"Security State Change": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows 11 25H2 - Computer"
},
"Security System Extension": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows 11 25H2 - Computer"
},
"System Integrity": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows 11 25H2 - Computer"
}
}
}
},
{
"id": "microsoft-sct-server2022",
"version": "microsoft-sct-server2022",
"sourceIds": [
"ms-sct"
],
"omitted": "unchanged",
"scope": "advanced-audit-policy-only",
"appliesTo": [
{
"roles": [
"MemberServer",
"DomainController",
"ADCS"
],
"minBuild": 20348,
"maxBuild": 20348
}
],
"controls": {},
"roleOverrides": {
"MemberServer": {
"Credential Validation": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Security Group Management": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"User Account Management": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Plug and Play Events": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Process Creation": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Account Lockout": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Group Membership": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Logon": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Other Logon/Logoff Events": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Special Logon": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Detailed File Share": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"File Share": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Other Object Access Events": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Removable Storage": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Audit Policy Change": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Authentication Policy Change": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"MPSSVC Rule-Level Policy Change": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Other Policy Change Events": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Sensitive Privilege Use": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Other System Events": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Security State Change": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Security System Extension": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"System Integrity": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Member Server"
}
},
"DomainController": {
"Credential Validation": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"Kerberos Authentication Service": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"Kerberos Service Ticket Operations": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"Computer Account Management": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"Other Account Management Events": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"Security Group Management": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"User Account Management": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"Plug and Play Events": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"Process Creation": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"Directory Service Access": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"Directory Service Changes": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"Account Lockout": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"Group Membership": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"Logon": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"Other Logon/Logoff Events": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"Special Logon": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"Detailed File Share": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"File Share": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"Other Object Access Events": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"Removable Storage": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"Audit Policy Change": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"Authentication Policy Change": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"MPSSVC Rule-Level Policy Change": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"Other Policy Change Events": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"Sensitive Privilege Use": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"Other System Events": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"Security State Change": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"Security System Extension": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
},
"System Integrity": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Domain Controller"
}
},
"ADCS": {
"Credential Validation": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Security Group Management": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"User Account Management": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Plug and Play Events": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Process Creation": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Account Lockout": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Group Membership": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Logon": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Other Logon/Logoff Events": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Special Logon": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Detailed File Share": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"File Share": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Other Object Access Events": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Removable Storage": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Audit Policy Change": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Authentication Policy Change": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"MPSSVC Rule-Level Policy Change": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Other Policy Change Events": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Sensitive Privilege Use": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Other System Events": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Security State Change": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"Security System Extension": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2022 - Member Server"
},
"System Integrity": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2022 - Member Server"
}
}
}
},
{
"id": "microsoft-sct-server2025-2602",
"version": "microsoft-sct-server2025-2602",
"sourceIds": [
"ms-sct"
],
"omitted": "unchanged",
"scope": "advanced-audit-policy-only",
"appliesTo": [
{
"roles": [
"MemberServer",
"DomainController",
"ADCS"
],
"minBuild": 26100,
"maxBuild": 26100
}
],
"controls": {},
"roleOverrides": {
"MemberServer": {
"Credential Validation": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Security Group Management": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"User Account Management": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Plug and Play Events": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Process Creation": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Account Lockout": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Group Membership": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Logon": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Other Logon/Logoff Events": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Special Logon": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Detailed File Share": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"File Share": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Other Object Access Events": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Removable Storage": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Audit Policy Change": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Authentication Policy Change": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Authorization Policy Change": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"MPSSVC Rule-Level Policy Change": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Other Policy Change Events": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Sensitive Privilege Use": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Other System Events": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Security State Change": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Security System Extension": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"System Integrity": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
}
},
"DomainController": {
"Credential Validation": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"Kerberos Authentication Service": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"Kerberos Service Ticket Operations": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"Computer Account Management": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"Other Account Management Events": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"Security Group Management": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"User Account Management": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"Plug and Play Events": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"Process Creation": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"Directory Service Access": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"Directory Service Changes": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"Account Lockout": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"Group Membership": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"Logon": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"Other Logon/Logoff Events": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"Special Logon": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"Detailed File Share": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"File Share": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"Other Object Access Events": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"Removable Storage": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"Audit Policy Change": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"Authentication Policy Change": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"Authorization Policy Change": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"MPSSVC Rule-Level Policy Change": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"Other Policy Change Events": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"Sensitive Privilege Use": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"Other System Events": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"Security State Change": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"Security System Extension": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
},
"System Integrity": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Domain Controller"
}
},
"ADCS": {
"Credential Validation": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Security Group Management": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"User Account Management": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Plug and Play Events": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Process Creation": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Account Lockout": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Group Membership": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Logon": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Other Logon/Logoff Events": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Special Logon": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Detailed File Share": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"File Share": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Other Object Access Events": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Removable Storage": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Audit Policy Change": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Authentication Policy Change": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Authorization Policy Change": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"MPSSVC Rule-Level Policy Change": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Other Policy Change Events": {
"mode": "exact",
"mask": 2,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Sensitive Privilege Use": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Other System Events": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Security State Change": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"Security System Extension": {
"mode": "exact",
"mask": 1,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
},
"System Integrity": {
"mode": "exact",
"mask": 3,
"evidence": "MSFT Windows Server 2025 v2602 - Member Server"
}
}
}
},
{
"id": "microsoft-stronger-reviewed-2026-09",
"version": "microsoft-stronger-reviewed-2026-09",
"sourceIds": [
"ms-audit"
],
"omitted": "unchanged",
"scope": "advanced-audit-policy-only",
"appliesTo": [
{
"roles": [
"Client"
],
"minBuild": 22000,
"maxBuild": 26200
},
{
"roles": [
"MemberServer",
"DomainController",
"ADCS"
],
"minBuild": 20348,
"maxBuild": 26100
}
],
"controls": {
"Credential Validation": {
"mode": "minimum",
"mask": 3
},
"Kerberos Authentication Service": {
"mode": "minimum",
"mask": 3
},
"Kerberos Service Ticket Operations": {
"mode": "minimum",
"mask": 3
},
"Other Account Logon Events": {
"mode": "minimum",
"mask": 3
},
"Computer Account Management": {
"mode": "minimum",
"mask": 3
},
"Other Account Management Events": {
"mode": "minimum",
"mask": 3
},
"Security Group Management": {
"mode": "minimum",
"mask": 3
},
"User Account Management": {
"mode": "minimum",
"mask": 3
},
"DPAPI Activity": {
"mode": "minimum",
"mask": 3
},
"Process Creation": {
"mode": "minimum",
"mask": 3
},
"Account Lockout": {
"mode": "minimum",
"mask": 1
},
"IPsec Main Mode": {
"mode": "optional",
"mask": 3,
"note": "Only if IPsec is in use; operator must opt in."
},
"Logoff": {
"mode": "minimum",
"mask": 1
},
"Special Logon": {
"mode": "minimum",
"mask": 3
},
"Audit Policy Change": {
"mode": "minimum",
"mask": 3
},
"Authentication Policy Change": {
"mode": "minimum",
"mask": 3
},
"MPSSVC Rule-Level Policy Change": {
"mode": "unchanged",
"note": "Source table does not distinguish success/failure; deliberately not inferred."
},
"IPsec Driver": {
"mode": "minimum",
"mask": 3
},
"Security State Change": {
"mode": "minimum",
"mask": 3
},
"Security System Extension": {
"mode": "minimum",
"mask": 3
},
"System Integrity": {
"mode": "minimum",
"mask": 3
},
"Directory Service Access": {
"mode": "minimum",
"mask": 3
},
"Directory Service Changes": {
"mode": "minimum",
"mask": 3
},
"Logon": {
"mode": "minimum",
"mask": 3
},
"Other Logon/Logoff Events": {
"mode": "minimum",
"mask": 3
}
},
"roleOverrides": {},
"note": "Stronger recommendation column, interpreted as minimum enabled flags; conditional IPsec is opt-in. Unspecified flags are preserved."
},
{
"id": "microsoft-wef-reviewed-2026-09",
"version": "microsoft-wef-reviewed-2026-09",
"sourceIds": [
"ms-wef"
],
"omitted": "unchanged",
"scope": "advanced-audit-policy-only",
"appliesTo": [
{
"roles": [
"Client"
],
"minBuild": 22000,
"maxBuild": 26200
},
{
"roles": [
"MemberServer",
"DomainController",
"ADCS"
],
"minBuild": 20348,
"maxBuild": 26100
}
],
"controls": {
"Credential Validation": {
"mode": "minimum",
"mask": 3
},
"Security Group Management": {
"mode": "minimum",
"mask": 1
},
"User Account Management": {
"mode": "minimum",
"mask": 3
},
"Computer Account Management": {
"mode": "minimum",
"mask": 3
},
"Other Account Management Events": {
"mode": "minimum",
"mask": 3
},
"Process Creation": {
"mode": "minimum",
"mask": 1
},
"Process Termination": {
"mode": "minimum",
"mask": 1
},
"User/Device Claims": {
"mode": "not-configured"
},
"IPsec Extended Mode": {
"mode": "not-configured"
},
"IPsec Quick Mode": {
"mode": "not-configured"
},
"Logon": {
"mode": "minimum",
"mask": 3
},
"Logoff": {
"mode": "minimum",
"mask": 1
},
"Other Logon/Logoff Events": {
"mode": "minimum",
"mask": 3
},
"Special Logon": {
"mode": "minimum",
"mask": 3
},
"Account Lockout": {
"mode": "minimum",
"mask": 1
},
"Application Generated": {
"mode": "not-configured"
},
"File Share": {
"mode": "minimum",
"mask": 1
},
"File System": {
"mode": "not-configured"
},
"Other Object Access Events": {
"mode": "not-configured"
},
"Registry": {
"mode": "not-configured"
},
"Removable Storage": {
"mode": "minimum",
"mask": 1
},
"Audit Policy Change": {
"mode": "minimum",
"mask": 3
},
"MPSSVC Rule-Level Policy Change": {
"mode": "minimum",
"mask": 3
},
"Other Policy Change Events": {
"mode": "minimum",
"mask": 3
},
"Authentication Policy Change": {
"mode": "minimum",
"mask": 3
},
"Authorization Policy Change": {
"mode": "minimum",
"mask": 3
},
"Sensitive Privilege Use": {
"mode": "not-configured"
},
"Security State Change": {
"mode": "minimum",
"mask": 3
},
"Security System Extension": {
"mode": "minimum",
"mask": 3
},
"System Integrity": {
"mode": "minimum",
"mask": 3
}
},
"roleOverrides": {},
"note": "Appendix A minimum policy only. Does not provision subscriptions, collector, channel permissions, SACLs or retention."
},
{
"id": "microsoft-identity-reviewed-2026-09",
"version": "microsoft-identity-reviewed-2026-09",
"sourceIds": [
"ms-identity"
],
"omitted": "unchanged",
"scope": "advanced-audit-policy-only",
"appliesTo": [
{
"roles": [
"DomainController",
"ADCS"
],
"minBuild": 20348,
"maxBuild": 26100
}
],
"controls": {},
"roleOverrides": {
"DomainController": {
"Credential Validation": {
"mode": "minimum",
"mask": 3
},
"Computer Account Management": {
"mode": "minimum",
"mask": 3
},
"Distribution Group Management": {
"mode": "minimum",
"mask": 3
},
"Security Group Management": {
"mode": "minimum",
"mask": 3
},
"User Account Management": {
"mode": "minimum",
"mask": 3
},
"Directory Service Changes": {
"mode": "minimum",
"mask": 3
},
"Directory Service Access": {
"mode": "minimum",
"mask": 3
},
"Security System Extension": {
"mode": "minimum",
"mask": 3
}
},
"ADCS": {
"Certification Services": {
"mode": "minimum",
"mask": 3
}
}
},
"note": "Advanced audit-policy subset only. AD SACLs, CA AuditFilter and other sensor prerequisites remain separate. This does not install any external sensor."
},
{
"id": "cis-win11-v4-l1",
"version": "cis-win11-v4-l1",
"sourceIds": [
"cis-client"
],
"omitted": "unchanged",
"scope": "advanced-audit-policy-only",
"appliesTo": [
{
"roles": [
"Client"
],
"minBuild": 22000,
"maxBuild": 26100
}
],
"controls": {},
"roleOverrides": {
"Client": {
"Credential Validation": {
"mode": "exact",
"mask": 3,
"evidence": "17.1.1; printed page 437; L1"
},
"Application Group Management": {
"mode": "exact",
"mask": 3,
"evidence": "17.2.1; printed page 440; L1"
},
"Security Group Management": {
"mode": "minimum",
"mask": 1,
"evidence": "17.2.2; printed page 442; L1"
},
"User Account Management": {
"mode": "exact",
"mask": 3,
"evidence": "17.2.3; printed page 444; L1"
},
"Plug and Play Events": {
"mode": "minimum",
"mask": 1,
"evidence": "17.3.1; printed page 448; L1"
},
"Process Creation": {
"mode": "minimum",
"mask": 1,
"evidence": "17.3.2; printed page 450; L1"
},
"Account Lockout": {
"mode": "minimum",
"mask": 2,
"evidence": "17.5.1; printed page 453; L1"
},
"Group Membership": {
"mode": "minimum",
"mask": 1,
"evidence": "17.5.2; printed page 455; L1"
},
"Logoff": {
"mode": "minimum",
"mask": 1,
"evidence": "17.5.3; printed page 457; L1"
},
"Logon": {
"mode": "exact",
"mask": 3,
"evidence": "17.5.4; printed page 459; L1"
},
"Other Logon/Logoff Events": {
"mode": "exact",
"mask": 3,
"evidence": "17.5.5; printed page 461; L1"
},
"Special Logon": {
"mode": "minimum",
"mask": 1,
"evidence": "17.5.6; printed page 463; L1"
},
"Detailed File Share": {
"mode": "minimum",
"mask": 2,
"evidence": "17.6.1; printed page 466; L1"
},
"File Share": {
"mode": "exact",
"mask": 3,
"evidence": "17.6.2; printed page 468; L1"
},
"Other Object Access Events": {
"mode": "exact",
"mask": 3,
"evidence": "17.6.3; printed page 470; L1"
},
"Removable Storage": {
"mode": "exact",
"mask": 3,
"evidence": "17.6.4; printed page 472; L1"
},
"Audit Policy Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.7.1; printed page 475; L1"
},
"Authentication Policy Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.7.2; printed page 477; L1"
},
"Authorization Policy Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.7.3; printed page 479; L1"
},
"MPSSVC Rule-Level Policy Change": {
"mode": "exact",
"mask": 3,
"evidence": "17.7.4; printed page 481; L1"
},
"Other Policy Change Events": {
"mode": "minimum",
"mask": 2,
"evidence": "17.7.5; printed page 484; L1"
},
"Sensitive Privilege Use": {
"mode": "exact",
"mask": 3,
"evidence": "17.8.1; printed page 487; L1"
},
"IPsec Driver": {
"mode": "exact",
"mask": 3,
"evidence": "17.9.1; printed page 491; L1"
},
"Other System Events": {
"mode": "exact",
"mask": 3,
"evidence": "17.9.2; printed page 494; L1"
},
"Security State Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.9.3; printed page 496; L1"
},
"Security System Extension": {
"mode": "minimum",
"mask": 1,
"evidence": "17.9.4; printed page 498; L1"
},
"System Integrity": {
"mode": "exact",
"mask": 3,
"evidence": "17.9.5; printed page 500; L1"
}
}
},
"note": "Historical v4.0.0. L1/L2 may have identical advanced audit policies; PowerShell and other controls are outside this profile scope."
},
{
"id": "cis-win11-v4-l2",
"version": "cis-win11-v4-l2",
"sourceIds": [
"cis-client"
],
"omitted": "unchanged",
"scope": "advanced-audit-policy-only",
"appliesTo": [
{
"roles": [
"Client"
],
"minBuild": 22000,
"maxBuild": 26100
}
],
"controls": {},
"roleOverrides": {
"Client": {
"Credential Validation": {
"mode": "exact",
"mask": 3,
"evidence": "17.1.1; printed page 437; L1"
},
"Application Group Management": {
"mode": "exact",
"mask": 3,
"evidence": "17.2.1; printed page 440; L1"
},
"Security Group Management": {
"mode": "minimum",
"mask": 1,
"evidence": "17.2.2; printed page 442; L1"
},
"User Account Management": {
"mode": "exact",
"mask": 3,
"evidence": "17.2.3; printed page 444; L1"
},
"Plug and Play Events": {
"mode": "minimum",
"mask": 1,
"evidence": "17.3.1; printed page 448; L1"
},
"Process Creation": {
"mode": "minimum",
"mask": 1,
"evidence": "17.3.2; printed page 450; L1"
},
"Account Lockout": {
"mode": "minimum",
"mask": 2,
"evidence": "17.5.1; printed page 453; L1"
},
"Group Membership": {
"mode": "minimum",
"mask": 1,
"evidence": "17.5.2; printed page 455; L1"
},
"Logoff": {
"mode": "minimum",
"mask": 1,
"evidence": "17.5.3; printed page 457; L1"
},
"Logon": {
"mode": "exact",
"mask": 3,
"evidence": "17.5.4; printed page 459; L1"
},
"Other Logon/Logoff Events": {
"mode": "exact",
"mask": 3,
"evidence": "17.5.5; printed page 461; L1"
},
"Special Logon": {
"mode": "minimum",
"mask": 1,
"evidence": "17.5.6; printed page 463; L1"
},
"Detailed File Share": {
"mode": "minimum",
"mask": 2,
"evidence": "17.6.1; printed page 466; L1"
},
"File Share": {
"mode": "exact",
"mask": 3,
"evidence": "17.6.2; printed page 468; L1"
},
"Other Object Access Events": {
"mode": "exact",
"mask": 3,
"evidence": "17.6.3; printed page 470; L1"
},
"Removable Storage": {
"mode": "exact",
"mask": 3,
"evidence": "17.6.4; printed page 472; L1"
},
"Audit Policy Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.7.1; printed page 475; L1"
},
"Authentication Policy Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.7.2; printed page 477; L1"
},
"Authorization Policy Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.7.3; printed page 479; L1"
},
"MPSSVC Rule-Level Policy Change": {
"mode": "exact",
"mask": 3,
"evidence": "17.7.4; printed page 481; L1"
},
"Other Policy Change Events": {
"mode": "minimum",
"mask": 2,
"evidence": "17.7.5; printed page 484; L1"
},
"Sensitive Privilege Use": {
"mode": "exact",
"mask": 3,
"evidence": "17.8.1; printed page 487; L1"
},
"IPsec Driver": {
"mode": "exact",
"mask": 3,
"evidence": "17.9.1; printed page 491; L1"
},
"Other System Events": {
"mode": "exact",
"mask": 3,
"evidence": "17.9.2; printed page 494; L1"
},
"Security State Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.9.3; printed page 496; L1"
},
"Security System Extension": {
"mode": "minimum",
"mask": 1,
"evidence": "17.9.4; printed page 498; L1"
},
"System Integrity": {
"mode": "exact",
"mask": 3,
"evidence": "17.9.5; printed page 500; L1"
}
}
},
"note": "Historical v4.0.0. L1/L2 may have identical advanced audit policies; PowerShell and other controls are outside this profile scope."
},
{
"id": "cis-server2022-v4-l1",
"version": "cis-server2022-v4-l1",
"sourceIds": [
"cis-server"
],
"omitted": "unchanged",
"scope": "advanced-audit-policy-only",
"appliesTo": [
{
"roles": [
"MemberServer",
"DomainController",
"ADCS"
],
"minBuild": 20348,
"maxBuild": 20348
}
],
"controls": {},
"roleOverrides": {
"MemberServer": {
"Credential Validation": {
"mode": "exact",
"mask": 3,
"evidence": "17.1.1; printed page 391; L1"
},
"Application Group Management": {
"mode": "exact",
"mask": 3,
"evidence": "17.2.1; printed page 398; L1"
},
"Security Group Management": {
"mode": "minimum",
"mask": 1,
"evidence": "17.2.5; printed page 407; L1"
},
"User Account Management": {
"mode": "exact",
"mask": 3,
"evidence": "17.2.6; printed page 410; L1"
},
"Plug and Play Events": {
"mode": "minimum",
"mask": 1,
"evidence": "17.3.1; printed page 414; L1"
},
"Process Creation": {
"mode": "minimum",
"mask": 1,
"evidence": "17.3.2; printed page 416; L1"
},
"Account Lockout": {
"mode": "minimum",
"mask": 2,
"evidence": "17.5.1; printed page 424; L1"
},
"Group Membership": {
"mode": "minimum",
"mask": 1,
"evidence": "17.5.2; printed page 426; L1"
},
"Logoff": {
"mode": "minimum",
"mask": 1,
"evidence": "17.5.3; printed page 428; L1"
},
"Logon": {
"mode": "exact",
"mask": 3,
"evidence": "17.5.4; printed page 430; L1"
},
"Other Logon/Logoff Events": {
"mode": "exact",
"mask": 3,
"evidence": "17.5.5; printed page 432; L1"
},
"Special Logon": {
"mode": "minimum",
"mask": 1,
"evidence": "17.5.6; printed page 434; L1"
},
"Detailed File Share": {
"mode": "minimum",
"mask": 2,
"evidence": "17.6.1; printed page 437; L1"
},
"File Share": {
"mode": "exact",
"mask": 3,
"evidence": "17.6.2; printed page 439; L1"
},
"Other Object Access Events": {
"mode": "exact",
"mask": 3,
"evidence": "17.6.3; printed page 441; L1"
},
"Removable Storage": {
"mode": "exact",
"mask": 3,
"evidence": "17.6.4; printed page 443; L1"
},
"Audit Policy Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.7.1; printed page 446; L1"
},
"Authentication Policy Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.7.2; printed page 448; L1"
},
"Authorization Policy Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.7.3; printed page 450; L1"
},
"MPSSVC Rule-Level Policy Change": {
"mode": "exact",
"mask": 3,
"evidence": "17.7.4; printed page 452; L1"
},
"Other Policy Change Events": {
"mode": "minimum",
"mask": 2,
"evidence": "17.7.5; printed page 455; L1"
},
"Sensitive Privilege Use": {
"mode": "exact",
"mask": 3,
"evidence": "17.8.1; printed page 458; L1"
},
"IPsec Driver": {
"mode": "exact",
"mask": 3,
"evidence": "17.9.1; printed page 462; L1"
},
"Other System Events": {
"mode": "exact",
"mask": 3,
"evidence": "17.9.2; printed page 465; L1"
},
"Security State Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.9.3; printed page 467; L1"
},
"Security System Extension": {
"mode": "minimum",
"mask": 1,
"evidence": "17.9.4; printed page 469; L1"
},
"System Integrity": {
"mode": "exact",
"mask": 3,
"evidence": "17.9.5; printed page 471; L1"
}
},
"DomainController": {
"Credential Validation": {
"mode": "exact",
"mask": 3,
"evidence": "17.1.1; printed page 391; L1"
},
"Kerberos Authentication Service": {
"mode": "exact",
"mask": 3,
"evidence": "17.1.2; printed page 393; L1"
},
"Kerberos Service Ticket Operations": {
"mode": "exact",
"mask": 3,
"evidence": "17.1.3; printed page 395; L1"
},
"Application Group Management": {
"mode": "exact",
"mask": 3,
"evidence": "17.2.1; printed page 398; L1"
},
"Computer Account Management": {
"mode": "minimum",
"mask": 1,
"evidence": "17.2.2; printed page 400; L1"
},
"Distribution Group Management": {
"mode": "minimum",
"mask": 1,
"evidence": "17.2.3; printed page 402; L1"
},
"Other Account Management Events": {
"mode": "minimum",
"mask": 1,
"evidence": "17.2.4; printed page 405; L1"
},
"Security Group Management": {
"mode": "minimum",
"mask": 1,
"evidence": "17.2.5; printed page 407; L1"
},
"User Account Management": {
"mode": "exact",
"mask": 3,
"evidence": "17.2.6; printed page 410; L1"
},
"Plug and Play Events": {
"mode": "minimum",
"mask": 1,
"evidence": "17.3.1; printed page 414; L1"
},
"Process Creation": {
"mode": "minimum",
"mask": 1,
"evidence": "17.3.2; printed page 416; L1"
},
"Directory Service Access": {
"mode": "minimum",
"mask": 2,
"evidence": "17.4.1; printed page 419; L1"
},
"Directory Service Changes": {
"mode": "minimum",
"mask": 1,
"evidence": "17.4.2; printed page 421; L1"
},
"Account Lockout": {
"mode": "minimum",
"mask": 2,
"evidence": "17.5.1; printed page 424; L1"
},
"Group Membership": {
"mode": "minimum",
"mask": 1,
"evidence": "17.5.2; printed page 426; L1"
},
"Logoff": {
"mode": "minimum",
"mask": 1,
"evidence": "17.5.3; printed page 428; L1"
},
"Logon": {
"mode": "exact",
"mask": 3,
"evidence": "17.5.4; printed page 430; L1"
},
"Other Logon/Logoff Events": {
"mode": "exact",
"mask": 3,
"evidence": "17.5.5; printed page 432; L1"
},
"Special Logon": {
"mode": "minimum",
"mask": 1,
"evidence": "17.5.6; printed page 434; L1"
},
"Detailed File Share": {
"mode": "minimum",
"mask": 2,
"evidence": "17.6.1; printed page 437; L1"
},
"File Share": {
"mode": "exact",
"mask": 3,
"evidence": "17.6.2; printed page 439; L1"
},
"Other Object Access Events": {
"mode": "exact",
"mask": 3,
"evidence": "17.6.3; printed page 441; L1"
},
"Removable Storage": {
"mode": "exact",
"mask": 3,
"evidence": "17.6.4; printed page 443; L1"
},
"Audit Policy Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.7.1; printed page 446; L1"
},
"Authentication Policy Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.7.2; printed page 448; L1"
},
"Authorization Policy Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.7.3; printed page 450; L1"
},
"MPSSVC Rule-Level Policy Change": {
"mode": "exact",
"mask": 3,
"evidence": "17.7.4; printed page 452; L1"
},
"Other Policy Change Events": {
"mode": "minimum",
"mask": 2,
"evidence": "17.7.5; printed page 455; L1"
},
"Sensitive Privilege Use": {
"mode": "exact",
"mask": 3,
"evidence": "17.8.1; printed page 458; L1"
},
"IPsec Driver": {
"mode": "exact",
"mask": 3,
"evidence": "17.9.1; printed page 462; L1"
},
"Other System Events": {
"mode": "exact",
"mask": 3,
"evidence": "17.9.2; printed page 465; L1"
},
"Security State Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.9.3; printed page 467; L1"
},
"Security System Extension": {
"mode": "minimum",
"mask": 1,
"evidence": "17.9.4; printed page 469; L1"
},
"System Integrity": {
"mode": "exact",
"mask": 3,
"evidence": "17.9.5; printed page 471; L1"
}
},
"ADCS": {
"Credential Validation": {
"mode": "exact",
"mask": 3,
"evidence": "17.1.1; printed page 391; L1"
},
"Application Group Management": {
"mode": "exact",
"mask": 3,
"evidence": "17.2.1; printed page 398; L1"
},
"Security Group Management": {
"mode": "minimum",
"mask": 1,
"evidence": "17.2.5; printed page 407; L1"
},
"User Account Management": {
"mode": "exact",
"mask": 3,
"evidence": "17.2.6; printed page 410; L1"
},
"Plug and Play Events": {
"mode": "minimum",
"mask": 1,
"evidence": "17.3.1; printed page 414; L1"
},
"Process Creation": {
"mode": "minimum",
"mask": 1,
"evidence": "17.3.2; printed page 416; L1"
},
"Account Lockout": {
"mode": "minimum",
"mask": 2,
"evidence": "17.5.1; printed page 424; L1"
},
"Group Membership": {
"mode": "minimum",
"mask": 1,
"evidence": "17.5.2; printed page 426; L1"
},
"Logoff": {
"mode": "minimum",
"mask": 1,
"evidence": "17.5.3; printed page 428; L1"
},
"Logon": {
"mode": "exact",
"mask": 3,
"evidence": "17.5.4; printed page 430; L1"
},
"Other Logon/Logoff Events": {
"mode": "exact",
"mask": 3,
"evidence": "17.5.5; printed page 432; L1"
},
"Special Logon": {
"mode": "minimum",
"mask": 1,
"evidence": "17.5.6; printed page 434; L1"
},
"Detailed File Share": {
"mode": "minimum",
"mask": 2,
"evidence": "17.6.1; printed page 437; L1"
},
"File Share": {
"mode": "exact",
"mask": 3,
"evidence": "17.6.2; printed page 439; L1"
},
"Other Object Access Events": {
"mode": "exact",
"mask": 3,
"evidence": "17.6.3; printed page 441; L1"
},
"Removable Storage": {
"mode": "exact",
"mask": 3,
"evidence": "17.6.4; printed page 443; L1"
},
"Audit Policy Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.7.1; printed page 446; L1"
},
"Authentication Policy Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.7.2; printed page 448; L1"
},
"Authorization Policy Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.7.3; printed page 450; L1"
},
"MPSSVC Rule-Level Policy Change": {
"mode": "exact",
"mask": 3,
"evidence": "17.7.4; printed page 452; L1"
},
"Other Policy Change Events": {
"mode": "minimum",
"mask": 2,
"evidence": "17.7.5; printed page 455; L1"
},
"Sensitive Privilege Use": {
"mode": "exact",
"mask": 3,
"evidence": "17.8.1; printed page 458; L1"
},
"IPsec Driver": {
"mode": "exact",
"mask": 3,
"evidence": "17.9.1; printed page 462; L1"
},
"Other System Events": {
"mode": "exact",
"mask": 3,
"evidence": "17.9.2; printed page 465; L1"
},
"Security State Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.9.3; printed page 467; L1"
},
"Security System Extension": {
"mode": "minimum",
"mask": 1,
"evidence": "17.9.4; printed page 469; L1"
},
"System Integrity": {
"mode": "exact",
"mask": 3,
"evidence": "17.9.5; printed page 471; L1"
}
}
},
"note": "Historical v4.0.0. L1/L2 may have identical advanced audit policies; PowerShell and other controls are outside this profile scope."
},
{
"id": "cis-server2022-v4-l2",
"version": "cis-server2022-v4-l2",
"sourceIds": [
"cis-server"
],
"omitted": "unchanged",
"scope": "advanced-audit-policy-only",
"appliesTo": [
{
"roles": [
"MemberServer",
"DomainController",
"ADCS"
],
"minBuild": 20348,
"maxBuild": 20348
}
],
"controls": {},
"roleOverrides": {
"MemberServer": {
"Credential Validation": {
"mode": "exact",
"mask": 3,
"evidence": "17.1.1; printed page 391; L1"
},
"Application Group Management": {
"mode": "exact",
"mask": 3,
"evidence": "17.2.1; printed page 398; L1"
},
"Security Group Management": {
"mode": "minimum",
"mask": 1,
"evidence": "17.2.5; printed page 407; L1"
},
"User Account Management": {
"mode": "exact",
"mask": 3,
"evidence": "17.2.6; printed page 410; L1"
},
"Plug and Play Events": {
"mode": "minimum",
"mask": 1,
"evidence": "17.3.1; printed page 414; L1"
},
"Process Creation": {
"mode": "minimum",
"mask": 1,
"evidence": "17.3.2; printed page 416; L1"
},
"Account Lockout": {
"mode": "minimum",
"mask": 2,
"evidence": "17.5.1; printed page 424; L1"
},
"Group Membership": {
"mode": "minimum",
"mask": 1,
"evidence": "17.5.2; printed page 426; L1"
},
"Logoff": {
"mode": "minimum",
"mask": 1,
"evidence": "17.5.3; printed page 428; L1"
},
"Logon": {
"mode": "exact",
"mask": 3,
"evidence": "17.5.4; printed page 430; L1"
},
"Other Logon/Logoff Events": {
"mode": "exact",
"mask": 3,
"evidence": "17.5.5; printed page 432; L1"
},
"Special Logon": {
"mode": "minimum",
"mask": 1,
"evidence": "17.5.6; printed page 434; L1"
},
"Detailed File Share": {
"mode": "minimum",
"mask": 2,
"evidence": "17.6.1; printed page 437; L1"
},
"File Share": {
"mode": "exact",
"mask": 3,
"evidence": "17.6.2; printed page 439; L1"
},
"Other Object Access Events": {
"mode": "exact",
"mask": 3,
"evidence": "17.6.3; printed page 441; L1"
},
"Removable Storage": {
"mode": "exact",
"mask": 3,
"evidence": "17.6.4; printed page 443; L1"
},
"Audit Policy Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.7.1; printed page 446; L1"
},
"Authentication Policy Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.7.2; printed page 448; L1"
},
"Authorization Policy Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.7.3; printed page 450; L1"
},
"MPSSVC Rule-Level Policy Change": {
"mode": "exact",
"mask": 3,
"evidence": "17.7.4; printed page 452; L1"
},
"Other Policy Change Events": {
"mode": "minimum",
"mask": 2,
"evidence": "17.7.5; printed page 455; L1"
},
"Sensitive Privilege Use": {
"mode": "exact",
"mask": 3,
"evidence": "17.8.1; printed page 458; L1"
},
"IPsec Driver": {
"mode": "exact",
"mask": 3,
"evidence": "17.9.1; printed page 462; L1"
},
"Other System Events": {
"mode": "exact",
"mask": 3,
"evidence": "17.9.2; printed page 465; L1"
},
"Security State Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.9.3; printed page 467; L1"
},
"Security System Extension": {
"mode": "minimum",
"mask": 1,
"evidence": "17.9.4; printed page 469; L1"
},
"System Integrity": {
"mode": "exact",
"mask": 3,
"evidence": "17.9.5; printed page 471; L1"
}
},
"DomainController": {
"Credential Validation": {
"mode": "exact",
"mask": 3,
"evidence": "17.1.1; printed page 391; L1"
},
"Kerberos Authentication Service": {
"mode": "exact",
"mask": 3,
"evidence": "17.1.2; printed page 393; L1"
},
"Kerberos Service Ticket Operations": {
"mode": "exact",
"mask": 3,
"evidence": "17.1.3; printed page 395; L1"
},
"Application Group Management": {
"mode": "exact",
"mask": 3,
"evidence": "17.2.1; printed page 398; L1"
},
"Computer Account Management": {
"mode": "minimum",
"mask": 1,
"evidence": "17.2.2; printed page 400; L1"
},
"Distribution Group Management": {
"mode": "minimum",
"mask": 1,
"evidence": "17.2.3; printed page 402; L1"
},
"Other Account Management Events": {
"mode": "minimum",
"mask": 1,
"evidence": "17.2.4; printed page 405; L1"
},
"Security Group Management": {
"mode": "minimum",
"mask": 1,
"evidence": "17.2.5; printed page 407; L1"
},
"User Account Management": {
"mode": "exact",
"mask": 3,
"evidence": "17.2.6; printed page 410; L1"
},
"Plug and Play Events": {
"mode": "minimum",
"mask": 1,
"evidence": "17.3.1; printed page 414; L1"
},
"Process Creation": {
"mode": "minimum",
"mask": 1,
"evidence": "17.3.2; printed page 416; L1"
},
"Directory Service Access": {
"mode": "minimum",
"mask": 2,
"evidence": "17.4.1; printed page 419; L1"
},
"Directory Service Changes": {
"mode": "minimum",
"mask": 1,
"evidence": "17.4.2; printed page 421; L1"
},
"Account Lockout": {
"mode": "minimum",
"mask": 2,
"evidence": "17.5.1; printed page 424; L1"
},
"Group Membership": {
"mode": "minimum",
"mask": 1,
"evidence": "17.5.2; printed page 426; L1"
},
"Logoff": {
"mode": "minimum",
"mask": 1,
"evidence": "17.5.3; printed page 428; L1"
},
"Logon": {
"mode": "exact",
"mask": 3,
"evidence": "17.5.4; printed page 430; L1"
},
"Other Logon/Logoff Events": {
"mode": "exact",
"mask": 3,
"evidence": "17.5.5; printed page 432; L1"
},
"Special Logon": {
"mode": "minimum",
"mask": 1,
"evidence": "17.5.6; printed page 434; L1"
},
"Detailed File Share": {
"mode": "minimum",
"mask": 2,
"evidence": "17.6.1; printed page 437; L1"
},
"File Share": {
"mode": "exact",
"mask": 3,
"evidence": "17.6.2; printed page 439; L1"
},
"Other Object Access Events": {
"mode": "exact",
"mask": 3,
"evidence": "17.6.3; printed page 441; L1"
},
"Removable Storage": {
"mode": "exact",
"mask": 3,
"evidence": "17.6.4; printed page 443; L1"
},
"Audit Policy Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.7.1; printed page 446; L1"
},
"Authentication Policy Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.7.2; printed page 448; L1"
},
"Authorization Policy Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.7.3; printed page 450; L1"
},
"MPSSVC Rule-Level Policy Change": {
"mode": "exact",
"mask": 3,
"evidence": "17.7.4; printed page 452; L1"
},
"Other Policy Change Events": {
"mode": "minimum",
"mask": 2,
"evidence": "17.7.5; printed page 455; L1"
},
"Sensitive Privilege Use": {
"mode": "exact",
"mask": 3,
"evidence": "17.8.1; printed page 458; L1"
},
"IPsec Driver": {
"mode": "exact",
"mask": 3,
"evidence": "17.9.1; printed page 462; L1"
},
"Other System Events": {
"mode": "exact",
"mask": 3,
"evidence": "17.9.2; printed page 465; L1"
},
"Security State Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.9.3; printed page 467; L1"
},
"Security System Extension": {
"mode": "minimum",
"mask": 1,
"evidence": "17.9.4; printed page 469; L1"
},
"System Integrity": {
"mode": "exact",
"mask": 3,
"evidence": "17.9.5; printed page 471; L1"
}
},
"ADCS": {
"Credential Validation": {
"mode": "exact",
"mask": 3,
"evidence": "17.1.1; printed page 391; L1"
},
"Application Group Management": {
"mode": "exact",
"mask": 3,
"evidence": "17.2.1; printed page 398; L1"
},
"Security Group Management": {
"mode": "minimum",
"mask": 1,
"evidence": "17.2.5; printed page 407; L1"
},
"User Account Management": {
"mode": "exact",
"mask": 3,
"evidence": "17.2.6; printed page 410; L1"
},
"Plug and Play Events": {
"mode": "minimum",
"mask": 1,
"evidence": "17.3.1; printed page 414; L1"
},
"Process Creation": {
"mode": "minimum",
"mask": 1,
"evidence": "17.3.2; printed page 416; L1"
},
"Account Lockout": {
"mode": "minimum",
"mask": 2,
"evidence": "17.5.1; printed page 424; L1"
},
"Group Membership": {
"mode": "minimum",
"mask": 1,
"evidence": "17.5.2; printed page 426; L1"
},
"Logoff": {
"mode": "minimum",
"mask": 1,
"evidence": "17.5.3; printed page 428; L1"
},
"Logon": {
"mode": "exact",
"mask": 3,
"evidence": "17.5.4; printed page 430; L1"
},
"Other Logon/Logoff Events": {
"mode": "exact",
"mask": 3,
"evidence": "17.5.5; printed page 432; L1"
},
"Special Logon": {
"mode": "minimum",
"mask": 1,
"evidence": "17.5.6; printed page 434; L1"
},
"Detailed File Share": {
"mode": "minimum",
"mask": 2,
"evidence": "17.6.1; printed page 437; L1"
},
"File Share": {
"mode": "exact",
"mask": 3,
"evidence": "17.6.2; printed page 439; L1"
},
"Other Object Access Events": {
"mode": "exact",
"mask": 3,
"evidence": "17.6.3; printed page 441; L1"
},
"Removable Storage": {
"mode": "exact",
"mask": 3,
"evidence": "17.6.4; printed page 443; L1"
},
"Audit Policy Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.7.1; printed page 446; L1"
},
"Authentication Policy Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.7.2; printed page 448; L1"
},
"Authorization Policy Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.7.3; printed page 450; L1"
},
"MPSSVC Rule-Level Policy Change": {
"mode": "exact",
"mask": 3,
"evidence": "17.7.4; printed page 452; L1"
},
"Other Policy Change Events": {
"mode": "minimum",
"mask": 2,
"evidence": "17.7.5; printed page 455; L1"
},
"Sensitive Privilege Use": {
"mode": "exact",
"mask": 3,
"evidence": "17.8.1; printed page 458; L1"
},
"IPsec Driver": {
"mode": "exact",
"mask": 3,
"evidence": "17.9.1; printed page 462; L1"
},
"Other System Events": {
"mode": "exact",
"mask": 3,
"evidence": "17.9.2; printed page 465; L1"
},
"Security State Change": {
"mode": "minimum",
"mask": 1,
"evidence": "17.9.3; printed page 467; L1"
},
"Security System Extension": {
"mode": "minimum",
"mask": 1,
"evidence": "17.9.4; printed page 469; L1"
},
"System Integrity": {
"mode": "exact",
"mask": 3,
"evidence": "17.9.5; printed page 471; L1"
}
}
},
"note": "Historical v4.0.0. L1/L2 may have identical advanced audit policies; PowerShell and other controls are outside this profile scope."
},
{
"id": "asd-native-2021-10",
"version": "asd-native-2021-10",
"sourceIds": [
"asd"
],
"omitted": "unchanged",
"scope": "advanced-audit-policy-only",
"appliesTo": [
{
"roles": [
"Client"
],
"minBuild": 22000,
"maxBuild": 26200
},
{
"roles": [
"MemberServer",
"DomainController",
"ADCS"
],
"minBuild": 20348,
"maxBuild": 26100
}
],
"controls": {
"Computer Account Management": {
"mode": "exact",
"mask": 3
},
"Other Account Management Events": {
"mode": "exact",
"mask": 3
},
"Security Group Management": {
"mode": "exact",
"mask": 3
},
"User Account Management": {
"mode": "exact",
"mask": 3
},
"Audit Policy Change": {
"mode": "exact",
"mask": 3
},
"Other Policy Change Events": {
"mode": "exact",
"mask": 3
},
"System Integrity": {
"mode": "exact",
"mask": 3
},
"Logon": {
"mode": "exact",
"mask": 3
},
"Other Logon/Logoff Events": {
"mode": "exact",
"mask": 3
},
"Special Logon": {
"mode": "exact",
"mask": 3
},
"File Share": {
"mode": "exact",
"mask": 3
},
"Other Object Access Events": {
"mode": "exact",
"mask": 3
},
"File System": {
"mode": "optional",
"mask": 3
},
"Registry": {
"mode": "optional",
"mask": 3
},
"Kernel Object": {
"mode": "exact",
"mask": 3
},
"Account Lockout": {
"mode": "exact",
"mask": 2
},
"Group Membership": {
"mode": "exact",
"mask": 1
},
"Logoff": {
"mode": "exact",
"mask": 1
},
"Process Creation": {
"mode": "exact",
"mask": 1
},
"Process Termination": {
"mode": "exact",
"mask": 1
},
"Detailed File Share": {
"mode": "not-configured"
}
},
"roleOverrides": {},
"note": "Native fallback only. Sysmon excluded. File System and Registry are optional and require SACLs. Detailed File Share Not Configured preserves effective state; it does not disable auditing."
}
]
}
Reference in new issue View Git Blame Copy Permalink