Audit Sensitive Privilege Use

Applies To: Windows 7, Windows Server 2008 R2

This security policy setting allows you to audit events generated when sensitive privileges (user rights) such as the following are used:

• A privileged service is called.

• One of the following privileges are called:

  • Act as part of the operating system

  • Back up files and directories

  • Create a token object

  • Debug programs

  • Enable computer and user accounts to be trusted for delegation

  • Generate security audits

  • Impersonate a client after authentication

  • Load and unload device drivers

  • Manage auditing and security log

  • Modify firmware environment values

  • Replace a process-level token

  • Restore files and directories

  • Take ownership of files or other objects

If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful attempts, and failure audits record unsuccessful attempts.

Event volume: High

Default: Not configured

If this policy setting is configured, the following events are generated. The events appear on computers running Windows Server 2008 R2, Windows Server 2008, Windows 7, or Windows Vista.