17.9.1 (L1) Ensure 'Audit IPsec Driver' is set to 'Success and Failure' (Automated)

System_AuditIPsecDriver

Description

This policy setting allows you to audit events generated by the IPsec filter driver such as the following: Startup and shutdown of the IPsec services. Network packets dropped due to integrity check failure. Network packets dropped due to replay check failure. Network packets dropped due to being in plaintext. Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card isn't working correctly or the driver needs to be updated. Inability to process IPsec filters.

Audit Policy CSPMicrosoftLearn

OMA-URI

Recommended Setting

Settings Catalog