2.2.30 (L1) Ensure 'Manage auditing and security log' is set to 'Administrators' (Automated)

2.2.30 (L1) Ensure 'Manage auditing and security log' is set to 'Administrators' (Automated)

Description

This user right determines which users can specify object access auditing options for individual resources, such as files, Active Directory objects, and registry keys. This security setting doesn't allow a user to enable file and object access auditing in general. You can view audited events in the security log of the Event Viewer. A user with this privilege can also view and clear the security log.

UserRights Policy CSP - Windows Client ManagementMicrosoftLearn

OMA-URI

./Device/Vendor/MSFT/Policy/Config/UserRights/ManageAuditingAndSecurityLog

Recommended Setting

Format: chr (string) Value: Administrators

Settings Catalog

YES

User Rights

Manage Auditing And Security Log