Title

Audit policy using subcategories is enabled. (Cat II impact)

Discussion

This policy setting allows administrators to enable the more precise auditing capabilities present in Windows Vista and later.

Check Content

Fix Text

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings” to “Enabled”.

Additional Identifiers

Rule ID: SV-25029r1_rule

Vulnerability ID: V-14230

Group Title: Audit Policy Subcategory Setting

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.