1.1.2.17 Set 'Audit Policy: Account Management: Security Group Management' to 'Success and Failure'

Information

This subcategory reports each event of security group management, such as when a security group is created, changed,
or deleted or when a member is added to or removed from a security group.

Solution

Make sure 'Account Management: Security Group Management is set to success and failure.

See Also

https://workbench.cisecurity.org/files/17

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12c., CSCv6|16

Plugin: Windows

Control ID: 8b7b2e11512c53ab382994cd35484084fa23ab71a9f6a2c3fdbfba0632d32f94