Auditing user accounts in Windows Server 2008 R2
Windows Group Policy is a powerful collection of configuration elements, and it can roll nicely into security configurations required for organizations of various types. One Group Policy configuration that may be useful is the User Account Management Audit Policy. This policy allows user account audits for events, including object being changed, created, deleted, renamed, enabled, and disabled, password changes, permissions assignment changes, and other actions. You can get to this setting by going to Computer Configuration | Windows Settings | Advanced Audit Policy Configuration | Account Management | User Account Management. The policy is shown in Figure A . Figure A Once you enable this configuration, relevant events are passed into the Windows Security log for user account objects. Let's go through a quick example with this audit configuration in place. On a test server, I did two events that will cause an audit event: I enabled the guest account, and then I...