How Windows Auditing Works

The Windows audit subsystem works in conjunction with components that make security decisions, and with the event log service, to generate security events in a trustworthy manner. Components that make security decisions—often called security reference monitors—are instrumented so that when a security decision is made or other security relevant activity takes place, these monitors notify the auditing subsystem and pass along the details of the activity. The auditing system formats these as event records, making sure that the data is presented in a consistent fashion, and discards any events that have been generated that are not supposed to be logged according to audit policy. The remaining events are sent to the event ...

Get Windows Server® 2008 Security Resource Kit now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.