3.4 Set 'Turn on Administrator Audit Logging' to 'True'

Information

Administrator audit logging is used to provide a log of the settings that are changed by administrators anywhere in the system. By default this setting is turned on to ensure discovery of configuration related security breaches.

Rationale:

Administrators may be able to reconfigure the system to expose a vulnerability with no record of the changes made.

Solution

To implement the recommended state, execute the following PowerShell cmdlet:

Set-AdminAuditLogConfig -AdminAuditLogEnabled $True

See Also

https://workbench.cisecurity.org/files/1514

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12

Plugin: Windows

Control ID: 7d62c5240767beedb5cf570cab8f0ff5c2c16bf0732be615fdd2f91f443f05e3