CIS Microsoft Windows 10 Enterprise Release 1909 Benchmark

17.8 PrivilegeUse

This section contains recommendations for configuring the Privilege Use audit policy.

17.8.1 (L1) Ensure 'Audit Sensitive Privilege Use' is set to 'Success and Failure' (Scored)

ProfileApplicability:

 Level 1 (L1) - Corporate/Enterprise Environment (general use)

Description:

This subcategory reports when a user account or service uses a sensitive privilege. A sensitive privilege includes the following user rights:

 Act as part of the operating system  Back up files and directories  Create a token object  Debug programs  Enable computer and user accounts to be trusted for delegation  Generate security audits  Impersonate a client after authentication  Load and unload device drivers  Manage auditing and security log  Modify firmware environment values  Replace a process-level token  Restore files and directories  Take ownership of files or other objects

Auditing this subcategory will create a high volume of events. Events for this subcategory include:

 4672: Special privileges assigned to new logon.  4673: A privileged service was called.  4674: An operation was attempted on a privileged object.

The recommended state for this setting is: Success and Failure .

Rationale:

Auditing these events may be useful when investigating a security incident.

486 | P a g e