CIS Microsoft Windows 10 Enterprise Release 1909 Benchmark

17.6.3 (L1) Ensure 'Audit Other Object Access Events' is set to 'Success and Failure' (Scored)

ProfileApplicability:

 Level 1 (L1) - Corporate/Enterprise Environment (general use)

Description:

This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects.

For scheduler jobs, the following are audited:

Job created. Job deleted. Job enabled. Job disabled. Job updated.

 



 

For COM+ objects, the following are audited:

Catalog object added. Catalog object updated. Catalog object deleted.

  

The recommended state for this setting is: Success and Failure .

Rationale:

The unexpected creation of scheduled tasks and COM+ objects could potentially be an indication of malicious activity. Since these types of actions are generally low volume, it may be useful to capture them in the audit logs for use during an investigation.

Audit:

Navigate to the UI Path articulated in the Remediation section and confirm it is set as prescribed.

466 | P a g e