An Auditors group will be created to restrict access to the Windows Event Logs.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-1137	1.010	SV-32258r1_rule	ECTP-1	Medium

Description
The Security Event Log contains information on security exceptions that occur on the system. This data is critical for identifying security vulnerabilities and intrusions. The Application and System logs can also contain information that is critical in assessing security events. Therefore, these logs must be protected from unauthorized access and modification. An Auditors group will be used to restrict access to auditing through the User Right “Manage auditing and security log” (V-1103) and for assigning permissions to event logs (V-1077). Only individuals who have auditing responsibilities (IAO, IAM, auditors, etc.) and the system administrators specifically responsible for maintaining a system should be members of this group.

Description

The Security Event Log contains information on security exceptions that occur on the system. This data is critical for identifying security vulnerabilities and intrusions. The Application and System logs can also contain information that is critical in assessing security events. Therefore, these logs must be protected from unauthorized access and modification. An Auditors group will be used to restrict access to auditing through the User Right “Manage auditing and security log” (V-1103) and for assigning permissions to event logs (V-1077). Only individuals who have auditing responsibilities (IAO, IAM, auditors, etc.) and the system administrators specifically responsible for maintaining a system should be members of this group.

STIG	Date
Windows Server 2008 R2 Member Server Security Technical Implementation Guide	2014-06-27

Details

Check Text ( C-32921r1_chk )
Interview the SA to determine if an Auditors group for controlling the Windows Event Logs has been created. The administrator(s) responsible for the installation and maintenance of the individual system(s) must be a member(s) of the Auditors group. This will permit the responsible administrator to enable and configure system auditing and perform maintenance functions related to the logs. Administrators who are not responsible for maintenance on an individual system will not be included in the Auditors group.

Check Text ( C-32921r1_chk )

Interview the SA to determine if an Auditors group for controlling the Windows Event Logs has been created.

The administrator(s) responsible for the installation and maintenance of the individual system(s) must be a member(s) of the Auditors group. This will permit the responsible administrator to enable and configure system auditing and perform maintenance functions related to the logs. Administrators who are not responsible for maintenance on an individual system will not be included in the Auditors group.

Fix Text (F-34r1_fix)
Create an Auditors group for controlling the Windows Event Logs and assign the necessary rights and access controls.