17.9.5 (L1) Ensure 'Audit System Integrity' is set to 'Success and Failure' (Automated)
System_AuditSystemIntegrity
This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: Events that couldn't be written to the event log because of a problem with the auditing system. A process that uses a local procedure call (LPC) port that isn't valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. The detection of a Remote Procedure Call (RPC) that compromises system integrity. The detection of a hash value of an executable file that isn't valid as determined by Code Integrity. Cryptographic operations that compromise system integrity.
Previous17.9.4 (L1) Ensure 'Audit Security System Extension' is set to include 'Success' (Automated)Next17.6 Object Access
Last updated