17.9.3 (L1) Ensure 'Audit Security State Change' is set to include 'Success' (Automated)

System_AuditSecurityStateChange

Description

This policy setting allows you to audit events generated by changes in the security state of the computer such as the following events: Startup and shutdown of the computer. Change of system time. Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured.

Audit Policy CSP - Windows Client ManagementMicrosoftLearn

OMA-URI

./Device/Vendor/MSFT/Policy/Config/Audit/System_AuditSecurityStateChange

Recommended Setting

Format: int Value: 1

Audit event on success.

Settings Catalog

YES

Auditing

Audit Security State Change