Skip to main content

Windows Server

Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity. Without it, your change reports may contain warnings, errors, or incomplete audit data.

CAUTION: Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the Antivirus Exclusions for Netwrix Auditor knowledge base article for additional information.

You can configure your IT Infrastructure for monitoring in one of the following ways:

  • Automatically through a monitoring plan – Netwrix recommends this method. If you select to automatically configure audit in the target environment, Auditor checks your current audit settings on each data collection and adjusts them if necessary.

  • Manually – You must adjust native audit settings manually to ensure collecting comprehensive and reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or configure them manually:

    • The Remote Registry and the Windows Management Instrumentation (WMI) service must be started. See the Enable Remote Registry and Windows Management Instrumentation Services topic and the Configure Windows Registry Audit Settings topic for additional information.

    • The following advanced audit policy settings must be configured:

      • The Audit: Force audit policy subcategory settings (Windows 7 or later) security option must be enabled.
      • Audit Security Group Management, Audit User Account Management, Audit Handle Manipulation, Audit Other Object Access Events, Audit Registry, Audit File Share, and Audit Policy Change advanced audit policies must be set to "Success".
      • See the Configure Local Audit Policies topic and the Configure Advanced Audit Policies topic for additional information.

    • The following legacy audit policies can be configured instead of advanced: Audit object access, Audit policy change, and Audit account management must be set to "Success".

    • The Enable Persistent Time Stamp local group policy must be enabled. You must configure this policy manually because Auditor doesn't enable it automatically. See the Configure Enable Persistent Time Stamp Policy topic for additional information.

    • The Application, Security, and System event log maximum size must be set to 4 GB. The retention method must be set to “Overwrite events as needed”. See the Adjusting Event Log Size and Retention Settings topic for additional information.

    • For auditing scheduled tasks, the Microsoft-Windows-TaskScheduler/Operational event log must be enabled and its maximum size must be set to 4 GB. The retention method of the log must be set to “Overwrite events as needed”.

    • For auditing DHCP, the Microsoft-Windows-Dhcp-Server/Operational event log must be enabled and its maximum size must be set to 4 GB. The retention method of the log must be set to “Overwrite events as needed”. See the Adjust DHCP Server Operational Log Settings topic for additional information.

    • For auditing DNS, the Microsoft-Windows-DNS-Server/Audit event log must be enabled and its maximum size must be set to 4 GB. The retention method of the log must be set to “Overwrite events as needed”.

    • The following inbound Firewall rules must be enabled:

      • Remote Event Log Management (NP-In)
      • Remote Event Log Management (RPC)
      • Remote Event Log Management (RPC-EPMAP)
      • Windows Management Instrumentation (ASync-In)
      • Windows Management Instrumentation (DCOM-In)
      • Windows Management Instrumentation (WMI-In)
      • Network Discovery (NB-Name-In)
      • File and Printer Sharing (NB-Name-In)
      • Remote Service Management (NP-In)
      • Remote Service Management (RPC)
      • Remote Service Management (RPC-EPMAP)
      • Performance Logs and Alerts (DCOM-In)
      • Performance Logs and Alerts (TCP-In)

    • If the audited servers are behind the Firewall, review the list of protocols and ports required for Netwrix Auditor and ensure that these ports are open. See the Windows Server Ports topic for additional information.

    • For auditing removable storage media, two Event Trace Session objects must be created. See the Configure Removable Storage Media for Monitoring topic for additional information.

    • If you want to use Network traffic compression, ensure that the Auditor console computer is accessible by its FQDN name.

    • For auditing IIS:

      • The Remote Registry service must be running and its Startup Type must be set to "Automatic".
      • The Microsoft-IIS-Configuration/Operational log must be enabled and its maximum size must be set to 4 GB. The retention method of the log must be set to “Overwrite events as needed”.

Whatever method you choose to configure Windows Server for auditing (manual or automated), also remember to do the following:

  1. Configure Data Collecting Account, as described in the Data Collecting Account topic.
  2. Configure required protocols and ports, as described in the Windows Server Ports topic.

Windows Server Monitoring Scope​

You can fine-tune Netwrix Auditor by specifying data that you want to exclude from the Windows Server monitoring scope. See the Windows Server Monitoring Scope topic for additional information.

Monitored Objects​

This section lists Windows Server components and settings whose changes Netwrix Auditor can monitor.

When monitoring a Windows Server, Netwrix Auditor needs to audit some registry settings. See Windows Server Registry Keys for additional information. If you want Netwrix Auditor to audit custom registry keys, see Monitoring Custom Registry Keys for additional information.

The following table has three levels: a Component is a system component you enable for auditing in the monitoring plan (see the Windows Server monitoring plan topic, Monitor changes to system components, for a description of each component); each component contains one or more Object types, which are the specific entities Netwrix Auditor tracks; and Attributes are the individual properties of that object type whose changes Netwrix Auditor reports.

Double asterisks (**) indicate the object types and attributes for which Netwrix Auditor reports the Who value as “Not Applicable”.

ComponentObject typeAttributes
General computer settingsComputer
  • System state changed to Started
  • System state changed to Stopped. Reason: Reason type
  • System state changed to Stopped. Reason: unexpected shutdown or system failure
Computer Name
  • Computer Description
  • Name
  • Domain
Environment Variables
  • Type
  • Value
Event Log
  • Event Log Cleared
General
  • Caption
  • Organization
  • Registered User
  • Serial Number
  • Service Pack**
  • Version**
Remote
  • Enable Remote Desktop on this computer
Startup and Recovery
  • Automatically Restart
  • Dump File
  • Dump Type
  • Overwrite any existing file
  • Send Alert
  • System Startup Delay
  • Write an Event
System Time
  • System time changed from ... to ...
  • Time zone changed
Add/Remove programsAdd or Remove Programs
  • Installed For**
  • Version
ServicesSystem Service
  • Action in case of failed service startup
  • Action in case of service stopping
  • Allow service to interact with desktop
  • Caption
  • Created
  • Deleted
  • Description
  • Name
  • Path to executable
  • Service Account
  • Service Type
  • Start Mode
  • Error Control
Audit policiesLocal Audit Policy
  • Added Audit settings Only for the Global Object Access Auditing advanced policies.
  • Successful audit enabled/disabled
  • Failure audit enabled/disabled
Per-User Local Audit Policy
  • Success audit include added
  • Success audit include removed
  • Failure audit include added
  • Failure audit include removed
  • Success audit exclude added
  • Success audit exclude removed
  • Failure audit exclude added
  • Failure audit exclude remove
HardwareBase Board**
  • Hosting Board
  • Status
  • Manufacturer
  • Product
  • Version
  • Serial Number
BIOS**
  • Manufacturer
  • Version
Bus**
  • Bus Type
  • Status
Cache Memory**
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Purpose
  • Status
CD-ROM Drive**
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Media Type
  • Name
  • SCSI Bus
  • SCSI Logical Unit
  • SCSI Port
  • SCSI Target ID
  • Status
Disk Partition**
  • Primary Partition
  • Size (bytes)
  • Starting offset (bytes)
Display Adapter**
  • Adapter RAM (bytes)
  • Adapter Type
  • Bits/Pixel
  • Configuration Manager Error Code
  • Driver Version
  • Installed Drivers
  • Last Error Description
  • Last Error Code
  • Refresh Rate
  • Resolution
  • Status
DMA**
  • Status
Floppy Drive**
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Status
Hard Drive**
  • Bytes/Sector
  • Configuration Manager Error Code
  • Interface Type
  • Last Error Description
  • Last Error Code
  • Media Loaded
  • Media Type
  • Model
  • Partitions
  • SCSI Bus
  • SCSI Logical Unit
  • SCSI Port
  • SCSI Target ID
  • Sectors/Track
  • Size (bytes)
  • Status
  • Total Cylinders
  • Total Heads
  • Total Sectors
  • Total Tracks
  • Tracks/Cylinder
IDE**
  • Configuration Manager Error Code
  • Description
  • Last Error Description
  • Last Error Code
  • Status
Infrared**
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Status
Keyboard**
  • Configuration Manager Error Code
  • Description
  • Last Error Description
  • Last Error Code
  • Layout
  • Name
  • Status
Logical Disk**
  • Description
  • File System
  • Size (bytes)
  • Status
Monitor**
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Monitor Type
  • Status
Network Adapter
  • Adapter Type *
  • Configuration Manager Error Code
  • Default IP Gateway *
  • DHCP Enabled*
  • DHCP Server
  • DNS Server Search Order
  • IP Address *
  • Last Error Description
  • Last Error Code
  • MAC Address
  • Network Connection Name
  • Network Connection Status
  • Service Name
  • Status * — indicates the properties whose changes may not be reported correctly, displaying "Who" (i.e. initiator's account) as System.
Network Protocol**
  • Description
  • Status
Parallel Ports**
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Status
PCMCIA Controller**
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Status
Physical Memory**
  • Capacity (bytes)
  • Status
  • Manufacturer
  • Memory Type
  • Speed
  • Part Number
  • Serial Number
Pointing Device**
  • Configuration Manager Error Code
  • Double Click Threshold
  • Handedness
  • Hardware Type
  • Last Error Description
  • Last Error Code
  • Number of buttons
  • Status
Printing
  • Comment**
  • Hidden**
  • Local**
  • Location**
  • Name**
  • Network**
  • Port Name**
  • Printer error information
  • Published**
  • Shared**
  • Share Name**
  • Status
Processor**
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Max Clock Speed (MHz)
  • Name
  • Status
SCSI**
  • Configuration Manager Error Code
  • Description
  • Last Error Description
  • Last Error Code
  • Status
Serial Ports**
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Maximum Bits/Second
  • Name
  • Status
Sound Device**
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Status
System Slot**
  • Slot Designation
  • Status
USB Controller**
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Name
  • Status
USB Hub**
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Name
  • Status
DHCP configurationServer role
  • Added
  • Removed
Server settings
  • Type:
  • IPv4
  • IPv4 Filters
  • IPv6
  • Action:
  • Modified
DHCP scope
  • Type:
  • IPv4
  • Multicast IPv4
  • Superscope for IPv4
  • IPv6
  • Action:
  • Added
  • Removed
  • Modified
  • Moved
DHCP Reservation
  • Type:
  • IPv4
  • IPv6
  • Action:
  • Added
  • Removed
  • Modified
DHCP Policy
  • Type:
  • IPv4
  • IPv4 server-wide
  • Action:
  • Added
  • Removed
  • Modified
  • Renamed
Removable mediaRemovable Storage Media**Netwrix Auditor doesn't report on floppy/optical disk and memory card storage medias. For removable storages, the When value reports actual time when a change was made and/or a target server was started.
  • Device class:
  • CD and DVD
  • Floppy Drives
  • Removable Disk
  • Tape Drives
  • Windows Portable Devices When the Audit Object Access local audit policy and/or the Audit Central Access Policy Staging \ Audit Removable Storage advanced audit policies are enabled on the target server, the gpupdate /force command execution issues removable storage restart. These actions are disclosed in Netwrix Auditor reports, search, and activity summaries. These actions are system, not user-effected.
Scheduled tasksScheduled Task
  • Account Name
  • Application
  • Comment
  • Creator
  • Enabled
  • Parameters
  • Triggers
Local users and groupsLocal Group
  • Description
  • Name
  • Members
Local User
  • Description
  • Disabled/Enabled
  • Full Name
  • Name
  • User can't change password
  • Password Never Expires
  • User must change password at next logon
note

Netwrix Auditor reports the Who value for DNS configuration settings only if the DNS server runs on Windows Server 2012 R2. See the following Microsoft article for additional information: Update adds query logging and change auditing to Windows DNS servers.

ComponentObject typeAttributes
DNS configurationDNS Server
  • Address Answer Limit
  • Allow Update
  • Auto Cache Update
  • Auto Config File Zones
  • Bind Secondaries
  • Boot Method
  • Default Aging State
  • Default No Refresh Interval
  • Default Refresh Interval
  • Disable Auto Reverse Zones
  • Disjoint Nets
  • Ds Available
  • Ds Polling Interval
  • Ds Tombstone Interval
  • EDns Cache Timeout
  • Enable Directory Partitions
  • Enable Dns Sec
  • Enable EDns Probes
  • CD-ROM D Enable Netmask Ordering
  • Event Log Level
  • Fail On Load If Bad Zone Data
  • Forward Delegations
  • Forwarders
  • Forwarding Timeout
  • Is Slave
  • Listen Addresses
  • Log File Max Size
  • Log File Path
  • Log Level
  • Loose Wildcarding
  • Max Cache TTL
  • Max Negative Cache TTL
  • Name Check Flag
  • No Recursion
  • Recursion Retry
  • Recursion Timeout
  • Round Robin
  • Rpc Protocol
  • Scavenging Interval
  • Secure Cache Against Pollution
  • Send Port
  • Server Addresses
DNS Zone
  • Aging State
  • Allow update
  • Auto created
  • Data file name
  • Ds integrated
  • Expires after
  • Forwarder slave
  • Forwarder timeout
  • Master servers
  • Minimum TTL
  • No refresh interval
  • Notify
  • Notify servers
  • Owner name
  • Paused
  • Primary server
  • Refresh interval
  • Responsible person
  • Retry interval
  • Reverse
  • Scavenge servers
  • Secondary servers
  • Secure secondaries
  • Shutdown
  • TTL
  • User NB stat
  • Use WINS
  • Zone type
note

Netwrix Auditor reports the Who value for DNS Resource Records only if the DNS server runs Windows Server 2012 R2. See the following Microsoft article for additional information: Update adds query logging and change auditing to Windows DNS servers.

ComponentObject typeAttributes
DNS resource recordsDNS AAAA
  • Container name
  • IPv6 Address
  • Owner name
  • Record class
  • TTL
  • Zone type
DNS AFSDB
  • Container name
  • Owner name
  • Server name
  • Server subtype
  • Record class
  • TTL
  • Zone type
DNS ATM A
  • ATM Address
  • Container name
  • Format
  • Owner name
  • Record class
  • TTL
  • Value
  • Zone type
DNS A
  • Container name
  • IP Address
  • Owner name
  • Record class
  • TTL
  • Zone type
DNS CNAME
  • Container name
  • FQDN for target host
  • Owner name
  • Record class
  • TTL
  • Zone type
DNS DHCID
  • Container name
  • DHCID (base 64)
  • Owner name
  • Record class
  • TTL
  • Zone type
DNS DNAME
  • Container name
  • FQDN for target domain
  • Owner name
  • Record class
  • TTL
  • Zone type
DNS DNSKEY
  • Algorithm
  • Container name
  • Key type
  • Key (base 64)
  • Name type
  • Owner name
  • Protocol
  • Record class
  • Signatory field
  • TTL
  • Zone type
DNS DS
  • Algorithm
  • Container name
  • Data
  • DigestType
  • Key tag
  • Owner name
  • Record class
  • TTL
  • Zone type
DNS HINFO
  • Container name
  • CPU type
  • Operating system
  • Owner name
  • Record class
  • TTL
  • Zone type
DNS ISDN
  • Container name
  • ISDN phone number and DDI
  • ISDN subaddress
  • Owner name
  • Record class
  • TTL
  • Zone type
DNS KEY
  • Algorithm
  • Container name
  • Key type
  • Key (base 64)
  • Name type
  • Owner name
  • Protocol
  • Record class
  • Signatory field
  • TTL
  • Zone type
DNS MB**
  • Container name
  • Mailbox host
  • Owner name
  • Record class
  • TTL
  • Zone type
DNS MD
  • Container name
  • MD host
  • Owner name
  • Record class
  • TTL
  • Zone type
DNS MF
  • Container name
  • MF host
  • Owner name
  • Record class
  • TTL
  • Zone type
DNS MG
  • Container name
  • Member mailbox
  • Owner name
  • Record class
  • TTL
  • Zone type
DNS MINFO
  • Container name
  • Error mailbox
  • Owner name
  • Responsible mailbox
  • Record class
  • TTL
  • Zone type
DNS MR
  • Container name
  • Owner name
  • Replacement mailbox
  • Record class
  • TTL
  • Zone type
DNS MX
  • Container name
  • FQDN of mail server
  • Mail server priority
  • Owner name
  • Record class
  • TTL
  • Zone type
DNS NAPTR
  • Container name
  • Flag string
  • Order
  • Owner name
  • Preference
  • Record class
  • Regular expression string
  • Replacement domain
  • Service string
  • TTL
  • Zone type
DNS NS
  • Container name
  • Name servers
  • Owner name
  • TTL
DNS NXT
  • Container name
  • Next domain name
  • Owner name
  • Record class
  • Record types
  • TTL
  • Zone type
DNS PTR
  • Container name
  • Owner name
  • PTR domain name
  • Record class
  • TTL
  • Zone type
DNS RP
  • Container name
  • Mailbox of responsible person
  • Optional associated text (TXT) record
  • Owner name
  • Record class
  • TTL
  • Zone type
DNS RRSIG
  • Algorithm
  • Container name
  • Key tag
  • Labels
  • Original TTL
  • Owner name
  • Record class
  • Signature expiration (GMT)
  • Signature inception (GMT)
  • Signature (base 64)
  • Signer's name
  • TTL
  • Type covered
  • Zone type
DNS RT
  • Container name
  • Intermediate host
  • Owner name
  • Preference
  • Record class
  • TTL
  • Zone type
DNS SIG
  • Algorithm
  • Container name
  • Key tag
  • Labels
  • Original TTL
  • Owner name
  • Record class
  • Signature expiration (GMT)
  • Signature inception (GMT)
  • Signature (base 64)
  • Signer's name
  • TTL
  • Type covered
  • Zone type
DNS SRV
  • Container name
  • Host offering this service
  • Owner name
  • Port number
  • Priority
  • Record class
  • TTL
  • Weight
  • Zone type
DNS TEXT
  • Container name
  • Owner name
  • Record class
  • Text
  • TTL
  • Zone type
DNS WINS
  • Cache time-out
  • Container name
  • Don't replicate this record
  • Lookup time-out
  • Owner name
  • Record class
  • Wins servers
  • Zone type
DNS WKS
  • Container name
  • IP address
  • Owner name
  • Protocol
  • Record class
  • Services
  • TTL
  • Zone type
DNS X25
  • Container name
  • Owner name
  • Record
  • Record class
  • TTL
  • X.121 PSDN address
  • Zone type
File sharesShare
  • Access-based enumeration
  • Caching
  • Description
  • Enable BranchCache
  • Encrypt data access
  • Folder path
  • Share permissions
  • User limit

Windows Server Registry Keys​

If you want to monitor changes to system components on a Windows Server, ensure that you configure Windows Registry audit settings on that Windows server.

This refers to the following keys:

  • HKEY_LOCAL_MACHINE\SOFTWARE
  • HKEY_LOCAL_MACHINE\SYSTEM
  • HKEY_USERS.DEFAULT

For these keys and subkeys, the following advanced permissions must be audited ("Successful" audit type required):

  • Set Value
  • Create Subkey
  • Delete
  • Write DAC
  • Write Owner

The following table lists all keys (and subkeys) involved in Windows Server auditing.

CategoryRegistry Keys
Hardware- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces*
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network{4D36E972-E325-11CE-BFC1-08002BE10318}*
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class{4D36E972-E325-11CE-BFC1-08002BE10318}*
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services*
General- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl*
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CrashControl*
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\CrashControl*
- HKEY_LOCAL_MACHINE\Software\WOW6432NODE\Microsoft\Windows NT\CurrentVersion*
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion*
Software- HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL*
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL*
Services- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services*
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services*
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services*
RemovableMedia- SYSTEM\CurrentControlSet\Enum*

Consider that audit data for the registry keys themselves will not appear in Netwrix Auditor reports, alerts, or search results, as the product uses it only as one of the sources for Activity Record formation.

  • You can configure these settings automatically using Netwrix Auditor, as described in the Settings for Data Collection topic. The product also applies the corresponding audit settings automatically after you select a checkbox under Monitor changes to system components on the General tab in the Windows Server data source properties.

Netwrix Auditor automatically adjusts audit settings only for the keys/subkeys involved in the monitoring of selected components (granular adjustment). For example, if you selected Services, the program adjusts the audit settings for the following subkeys:

  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services(|\.*)

  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services(|\.*)

  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services(|\.*)

  • To configure the audit settings manually, refer to the Configure Windows Registry Audit Settings topic for additional information.

Monitoring Custom Registry Keys​

Step 1 – On the computer where Auditor Server resides, navigate to %Netwrix Auditor installation folder%\Windows Server Auditing.

customregistrykeyentry

Step 2 – Edit the following parameters of the customregistrykeys.txt file:

monitoring plan name,server name,registry key name

For example:

#*,productionserver1.corp.local,HKEY_LOCAL_MACHINE\\SYSTEM\\RNG

Step 3 – Consider the following:

  • Each entry must be a separate line.
  • The product supports wildcards (* and ?), except for the registry key name field. Put a backslash () in front of (*), (?), (,), and () if they are a part of an entry value.
  • The product treats lines that start with the # sign as comments and ignores them.

customregistrykey

NOTE: In some cases, Who will be the system and When will be collection time, because there is no necessary event in the Security log with this path.

VM Template Cloning​

Netwrix Auditor supports VM cloning, but you must complete an additional setup process before deployment.

Every monitored VM instance gets a unique ID assigned for monitoring and data collection purposes. To ensure proper operation, you must exclude the VM template from the monitoring scope beforehand. Omitting the VM template allows Netwrix Auditor to assign unique IDs correctly and collect data as intended.

Step 1 – In main Netwrix Auditor menu, select Monitoring plans.

Step 2 – Select your Windows Server monitoring plan and click Edit.

Step 3 – Choose the AD Container containing the template VM and click Edit data source in the right pane.

Step 4 – In the left pane, select Containers and Computers.

Step 5 – Check the Exclude these objects checkbox and add the template VM by clicking Add Computer.

The VM template server is now in the exclusions list and ready to use.