With expert guidance to bring you up to speed on Windows auditing, logging, and event systems to help you exploit the full capabilities of these powerful components, this book offers scenariobased instruction providing clear illustration of how these events unfold in the real world. -- Go deep into Windows security tools to implement more robust protocols and processes. 'Windows Security Monitoring' goes beyond Windows admin and security certification guides to provide in-depth information for security professionals. Written by a Microsoft security program manager, DEFCON organizer and CISSP, this book digs deep into the underused tools that help you keep Windows systems secure. Edited summary from book.

Includes index.

Cover; Title Page; Copyright; About the Author; About the Technical Editor; Credits; Acknowledgments; Contents; Introduction; Who This Book Is For; What This Book Covers; How This Book Is Structured; What You Need to Use This Book; Conventions; What's on the Website; Part I: Introduction to Windows Security Monitoring; Chapter 1: Windows Security Logging and Monitoring Policy; Security Logging; Security Logs; System Requirements; PII and PHI; Availability and Protection; Configuration Changes; Secure Storage; Centralized Collection; Backup and Retention; Periodic Review; Security Monitoring. CommunicationsAudit Tool and Technologies; Network Intrusion Detection Systems; Host-based Intrusion Detection Systems; System Reviews; Reporting; Part II: Windows Auditing Subsystem; Chapter 2: Auditing Subsystem Architecture; Legacy Auditing Settings; Advanced Auditing Settings; Set Advanced Audit Settings via Local Group Policy; Set Advanced Audit Settings via Domain Group Policy; Set Advanced Audit Settings in the Local Security Authority (LSA) Policy Database; Read Current LSA Policy Database Advanced Audit Policy Settings; Advanced Audit Policies Enforcement and Legacy Policies Rollback. Switch from Advanced Audit Settings to Legacy SettingsSwitch from Legacy Audit Settings to Advanced Settings; Windows Auditing Group Policy Settings; Manage Auditing and Security Log; Generate Security Audits; Security Auditing Policy Security Descriptor; Group Policy: â#x80;#x9C;Audit: Shut Down System Immediately If Unable to Log Security Auditsâ#x80;#x9D;; Group Policy: Protected Event Logging; Group Policy: â#x80;#x9C;Audit: Audit the Use of Backup and Restore Privilegeâ#x80;#x9D;; Group Policy: â#x80;#x9C;Audit: Audit the Access of Global System Objectsâ#x80;#x9D;; Audit the Access of Global System Container Objects. Windows Event Log Service: Security Event Log SettingsChanging the Maximum Security Event Log File Size; Group Policy: Control Event Log Behavior When the Log File Reaches Its Maximum Size; Group Policy: Back Up Log Automatically When Full; Group Policy: Control the Location of the Log File; Security Event Log Security Descriptor; Guest and Anonymous Access to the Security Event Log; Windows Auditing Architecture; Windows Auditing Policy Flow; LsaSetInformationPolicy and LsaQueryInformationPolicy Functions Route; Windows Auditing Event Flow; LSASS. EXE Security Event Flow. NTOSKRNL. EXE Security Event FlowSecurity Event Structure; Chapter 3: Auditing Subcategories and Recommendations; Account Logon; Audit Credential Validation; Audit Kerberos Authentication Service; Audit Kerberos Service Ticket Operations; Audit Other Account Logon Events; Account Management; Audit Application Group Management; Audit Computer Account Management; Audit Distribution Group Management; Audit Other Account Management Events; Audit Security Group Management; Audit User Account Management; Detailed Tracking; Audit DPAPI Activity; Audit PNP Activity; Audit Process Creation.