Configuring Windows XP Auditing with secpol.msc

In Windows XP Professional, the Local Security Policy console (secpol.msc) served as the primary administrative tool for managing local security baselines, including system auditing. By configuring Audit Policies within this Microsoft Management Console (MMC) snap-in, administrators could track critical user activities, system modifications, and security events, outputting the results directly to the Windows Event Viewer to detect unauthorized activity and monitor system health.

Accessing Audit Policies

System auditing was restricted to Windows XP Professional, as Windows XP Home Edition lacked the Local Security Policy management console. Administrators accessed the tool by opening the Run dialog box (Windows Key + R), typing secpol.msc, and pressing Enter. Within the console tree, the auditing options were located by expanding Security Settings, selecting Local Policies, and clicking on Audit Policy.

Configurable Audit Categories

The Audit Policy node in Windows XP Professional provided nine distinct event categories that administrators could individually configure:

  • Audit account logon events: Tracked instances when an account logged on or off a domain controller (relevant in domain environments).
  • Audit account management: Monitored changes to user accounts or groups, such as password changes, account creation, or account disabling.
  • Audit directory service access: Logged attempts to access Active Directory objects.
  • Audit logon events: Recorded local interactive logons, network logons, logoffs, and failed logon attempts on the specific XP workstation.
  • Audit object access: Monitored access to files, folders, registry keys, and printers protected by NTFS permissions.
  • Audit policy change: Logged modifications to user rights assignment policies, firewall rules, or audit policies themselves.
  • Audit privilege use: Tracked when users exercised specific user rights (e.g., changing the system time or taking ownership of files).
  • Audit process tracking: Monitored detailed process activity, such as program execution, termination, and indirect object access.
  • Audit system events: Recorded critical operating system actions, such as system restarts, shutdowns, and security log clearing.

Configuration Process

Each category within the Audit Policy container was set to "No auditing" by default. To enable logging, an administrator double-clicked an individual policy and selected one or both of the following checkboxes:

  • Success: Created an audit record whenever the specified event successfully occurred.
  • Failure: Created an audit record whenever an attempt failed (such as an incorrect password attempt or an unauthorized file access request).

Enabling Object-Level Auditing

For policies like Audit object access, enabling the setting within secpol.msc was only the first step. To track specific files or folders:

  1. The drive had to be formatted with NTFS.
  2. The user had to disable "Simple File Sharing" via Windows Explorer folder options.
  3. The administrator had to right-click the target file or folder, select Properties, navigate to the Security tab, click Advanced, and access the Auditing tab.
  4. From there, specific users or groups were added to the System Access Control List (SACL), defining whether to monitor actions like reading, writing, deleting, or changing permissions.

Reviewing Audited Events

Once policies were enforced, the operating system wrote the triggered events to the Security log. Administrators monitored and analyzed these records using the Event Viewer (eventvwr.msc), where entries were classified as "Success Audit" (indicated by a key icon) or "Failure Audit" (indicated by a lock icon), providing event IDs, timestamps, user identities, and technical details for each logged action.