Title

The UEM server must initiate session auditing upon startup. (Cat II impact)

Discussion

If auditing is enabled late in the startup process, the actions of some start-up processes may not be audited. Some audit systems also maintain state information only available if auditing is enabled before a given process is created.

Check Content

Verify the UEM server initiate session auditing upon startup. If the UEM server does not initiate session auditing upon startup, this is a finding.

Fix Text

Configure the UEM server to initiate session auditing upon startup.

Additional Identifiers

Rule ID: SRG-APP-000092-UEM-000053_rule

Vulnerability ID: SRG-APP-000092-UEM-000053

Group Title: SRG-APP-000092-UEM-000053

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.