> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/03-windows-security-basics/basic-audit-policy.md).

# Basic Audit Policy

## Objective

Understand what Windows auditing does and where basic audit settings are configured.

## Why Audit Policy Matters

Windows does not record every possible security event automatically. Audit policy determines which categories of activity are written to the Security log.

For example, auditing can record:

* logon activity
* account management
* policy changes
* privilege use
* process creation
* object access

## Lab System

Start on `DC01`.

## Review the Domain Audit Policy

1. Open **Group Policy Management**.
2. Locate the policy applied to the ZyberLab domain.
3. Edit the policy.
4. Navigate to:

```
Computer Configuration
└── Policies
    └── Windows Settings
        └── Security Settings
            └── Advanced Audit Policy Configuration
                └── Audit Policies
```

Review the available categories without changing everything at once.

Important beginner categories include:

* Account Logon
* Account Management
* Logon/Logoff
* Policy Change
* System

## Success and Failure Auditing

Many audit settings can record:

* **Success** — the action completed successfully
* **Failure** — the action was attempted but did not complete successfully

For example, logon auditing can help record both successful and failed authentication activity.

## Keep the Lab Simple

Do not enable every audit category simply because it is available.

More logging can provide better visibility, but it also creates more events to store, collect, review, and understand.

For ZyberLab, enable or change audit settings only when a specific later exercise requires them.

## Verify Existing Events

Return to:

```
Event Viewer
└── Windows Logs
    └── Security
```

Review the events generated during the earlier successful and failed logon exercises.

Connect what you see in Event Viewer with the idea that audit policy determines which activities Windows records.

## Security Relevance

Good security monitoring depends on useful telemetry. If an important activity is not audited, a SIEM or analyst may have nothing to investigate later.

At the same time, enabling excessive logging without a purpose can create noise.

The goal is therefore:

**Collect enough evidence to detect and investigate important activity without creating unnecessary noise.**

## Key Takeaways

* Audit policy controls which security activities Windows records.
* Advanced Audit Policy provides more detailed control than broad legacy categories.
* Success and failure auditing serve different purposes.
* Logging should be intentional and linked to real detection or investigation needs.