Vista - A New Vista Security Policy on Audit:Force Audit Policy Subcategor

10-19-2007

SCENoApplyLegayAuditPolicy is the registry Value that stored the value of the
Security Policy Audit: Force Audit policy subcategory settings(Windows Vista
or later) to override audit policy category settings

There are 3 instances of this Registry value on a Vista machine. What do
each of these correspond to?
eg.Under
1. HKEY_LOCAL_MACHINE\System\CurrentControlSet001\Control\Lsa
2. HKEY_LOCAL_MACHINE\System\CurrentControlSet002\Control\Lsa
3. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa

Which instance is the one that stores the value as set in
Group Policy object Editor for
Local Computer Policy:Security Settings\Local Policies\Security
Options\Audit: Force audit policy subcategory settings(Windows Vista or
later) to override audit policy category settings?

10-19-2007

On Fri, 19 Oct 2007 06:11:01 -0700, Gayle wrote:

Quote:

> SCENoApplyLegayAuditPolicy is the registry Value that stored the value of the
> Security Policy Audit: Force Audit policy subcategory settings(Windows Vista
> or later) to override audit policy category settings
>
> There are 3 instances of this Registry value on a Vista machine. What do
> each of these correspond to?
> eg.Under
> 1. HKEY_LOCAL_MACHINE\System\CurrentControlSet001\Control\Lsa
> 2. HKEY_LOCAL_MACHINE\System\CurrentControlSet002\Control\Lsa
> 3. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
>
> Which instance is the one that stores the value as set in
> Group Policy object Editor for
> Local Computer Policy:Security Settings\Local Policies\Security
> Options\Audit: Force audit policy subcategory settings(Windows Vista or
> later) to override audit policy category settings?

http://support.microsoft.com/kb/100010

--
Paul Adare
MVP - Virtual Machines
http://www.identit.ca
Any given program will expand to fill available memory.

10-19-2007	#1 (permalink)
Gayle n/a posts	A New Vista Security Policy on Audit:Force Audit Policy Subcategor SCENoApplyLegayAuditPolicy is the registry Value that stored the value of the Security Policy Audit: Force Audit policy subcategory settings(Windows Vista or later) to override audit policy category settings There are 3 instances of this Registry value on a Vista machine. What do each of these correspond to? eg.Under 1. HKEY_LOCAL_MACHINE\System\CurrentControlSet001\Control\Lsa 2. HKEY_LOCAL_MACHINE\System\CurrentControlSet002\Control\Lsa 3. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa Which instance is the one that stores the value as set in Group Policy object Editor for Local Computer Policy:Security Settings\Local Policies\Security Options\Audit: Force audit policy subcategory settings(Windows Vista or later) to override audit policy category settings?
My System Specs

10-19-2007	#2 (permalink)
Paul Adare n/a posts	Re: A New Vista Security Policy on Audit:Force Audit Policy Subcategor On Fri, 19 Oct 2007 06:11:01 -0700, Gayle wrote: Quote: > SCENoApplyLegayAuditPolicy is the registry Value that stored the value of the > Security Policy Audit: Force Audit policy subcategory settings(Windows Vista > or later) to override audit policy category settings > > There are 3 instances of this Registry value on a Vista machine. What do > each of these correspond to? > eg.Under > 1. HKEY_LOCAL_MACHINE\System\CurrentControlSet001\Control\Lsa > 2. HKEY_LOCAL_MACHINE\System\CurrentControlSet002\Control\Lsa > 3. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa > > Which instance is the one that stores the value as set in > Group Policy object Editor for > Local Computer Policy:Security Settings\Local Policies\Security > Options\Audit: Force audit policy subcategory settings(Windows Vista or > later) to override audit policy category settings? http://support.microsoft.com/kb/100010 -- Paul Adare MVP - Virtual Machines http://www.identit.ca Any given program will expand to fill available memory.
My System Specs

Similar Threads
Thread	Forum
Script (s) to help with file security audit	VB Script
Event viewer security audit failures	Software
Re: Security Event Log Audit Failure 5038 in Vista SP1 tcpip.sys	Vista General
Security Event Log Audit Failure 5038 in Vista SP1 tcpip.sys	Vista General
Strange security audit events	Vista security