Creating Audit Policies In Windows Server 2003 Part I

Network administrators are always concerned about security. Many companies have even hired specialists who are dedicated to network security and protecting confidential company information.

Operating systems include numerous different features that administrators can take advantage of when securing data. However, with all the security measures in place, how can you be sure that your confidential data really is secure? One way is by implementing an audit policy.

What is auditing?
Auditing is a general tool that has been around since the days of Windows NT. Auditing is very similar to Performance Monitor, in that it waits for a specific event to occur, and then reports on it within the Event Viewer. The events can be performed by users, servers or applications. An example of such an event is a user logging in to the network. Depending on how you configure auditing, a record of each logon can be recorded every time one occurs.

Now that you are familiar with what auditing is, you need to start thinking about how to make it useful. If you audit every user and every system event, it’s possible that the server will log hundreds of events every minute. There are many disadvantages to logging all events. The log will fill up very quickly, possibly logging hundreds of events every minute. Once the log reaches its maximum size, no additional events are logged until it is cleared.

Excessive logging can also cause performance problems for the server since logging consumes disk and processor time. Another downside to logging every event is that the logs cease to be meaningful. If you suspect that a security breach may have occurred, locating a record of it can be like looking for the proverbial needle in a haystack.

Therefore, to make logging effective, you should monitor meaningful events rather than every event. Start by identifying those events that could potentially cause a security breach, such as unauthorized users accessing confidential information.

[tags]windows server 2003, audit policy, audit policies[/tags]