Audit Policy Settings

• Why logon auditing is needed
• Configure auditing with Local Security Policy
• Configure and verify auditing with auditpol

Enable Success and Failure auditing for Audit Logon on the Windows Server running RdpGuard. You can use Local Security Policy or the auditpol command-line tool.

RdpGuard uses failed logon events from the Windows Security log for RDP detection and RD Web Access detection.

Successful logon events allow RdpGuard to reset failed-attempt counters after a successful Windows logon and trigger successful logon notifications.

Configure auditing on the server you want to protect. Administrator permissions are required for the steps below.

1. Press Windows + R, enter secpol.msc, and click OK.

   

2. In Local Security Policy, go to Security Settings, Advanced Audit Policy Configuration, System Audit Policies - Local Group Policy Object, Logon/Logoff.

   

3. In the right pane, double-click Audit Logon. The Audit Logon Properties dialog will open:

   

4. Select Configure the following audit events, then select both Success and Failure. Click OK to save the policy.

   The Audit Events column should show Success and Failure for Audit Logon. Use the verification command below to check the effective policy.

1. Open Command Prompt as Administrator.

2. Run this command to enable auditing of successful and failed logons:

   auditpol /set /subcategory:"Logon" /success:enable /failure:enable

   A successful update displays:

   The command was successfully executed.

3. Verify the effective policy with:

   auditpol /get /subcategory:"Logon"

   The Logon row should show Success and Failure.

   

On a non-English Windows installation, the subcategory name may be different. You can use the Logon subcategory GUID in either command:

/subcategory:"{0CCE9215-69AE-11D9-BED3-505054503030}"

If Group Policy manages auditing on this server, configure the setting in the applicable Group Policy Object. Group Policy can overwrite local auditpol changes.