Q

Setting auditing policies in the registry

I am an administrator, and I want to know how I can set auditing policies in the registry so that the system stops when the security log is full.
There is a registry setting called CrashOnAuditFail, but as you'll see below, you can configure this setting via Group Policy. I don't recommend doing this unless your security requirements really demand it (such as compliance with the Trusted Computer Security Evaluation Criteria (TCSEC) program's C2 security level or for the Common Criteria for Information Technology Security Evaluation) and you have an archival and log clearing process in place to prevent your log from filling up under normal circumstances.

That being said, if your system is unable to, all you need to do is edit a Group Policy Object that gets applied to your server(s) and maneuver to computer configuration/Windows settings/security settings/local policies/security options and enable the audit: Shut down system immediately if unable to log security audits.

If you don't use Group Policy, you'll find the same setting in Local Security Policy for each server. If you enable this setting and your system's security log fills up, it will immediately halt with a blue screen. To recover, you will need to restart the system. At this point, the system will boot in a special mode that disables the network from starting. Log on at the console as a member of administrators. Open event viewer, archive the security log and then clear it. Then you'll need to reset the CrashOnAuditFail registry setting so that the system will know it can start the network. Open the registry editor and find the CrashOnAuditFail setting under HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlLsa. Set the value to 1, and then reboot.

This was first published in October 2004

Dig deeper on User passwords and network permissions

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchVirtualDesktop

SearchWindowsServer

SearchExchange

Close