ADLOG-001: Advanced Audit Policy Configured
- Platform
- Active Directory
- Category
- AD Logging & EDR Posture
- Severity
- High
- Zero Trust pillar
- Visibility & Analytics (weight 2)
- Golden fixtures
- 1
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
The check fetches the Default Domain Controllers Policy (GUID {6AC1786C-016F-11D2-945F-00C04FB984F9}) from SYSVOL and tests for the existence and content of the Advanced Audit Policy file: \\<domain>\SYSVOL\<domain>\Policies\{6AC1786C-016F-11D2-945F-00C04FB984F9}\Machine\Microsoft\Windows NT\Audit\audit.csv This CSV is the canonical artifact written by Group Policy when an administrator configures any setting under Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration. Its presence is a deterministic signal that the Default Domain Controllers Policy is delivering subcategory-level audit settings to every Domain Controller. The check also reads the SecEdit\GptTmpl.inf file in the same GPO and the Registry.pol blob looking for the Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings", because if that option is not set to Enabled (registry value SCENoApplyLegacyAuditPolicy = 1 under HKLM\System\CurrentControlSet\Control\Lsa) the legacy nine categories silently win over the advanced subcategories at policy merge time, which means audit.csv may be present but ignored. The check does not enumerate the specific subcategories yet; that is the job of downstream ADLOG checks (ADLOG-002 through ADLOG-007). ADLOG-001 is the gate: if it fails, every finer-grained logging check is moot because the framework is not in effect.
Why it matters
Without subcategory-level auditing, the Security log on a Domain Controller cannot distinguish a Kerberos service ticket request (Event ID 4769, the primary Kerberoasting indicator) from a credential validation (4776) from a Kerberos AS-REQ (4768). The legacy "Audit account logon events" category lumps all of these together and the analyst loses the ability to write detections for: Kerberoasting (4769 with ticket encryption type 0x17 RC4-HMAC), AS-REP roasting (4768 where Pre-Authentication Type 0 was used), DCSync (4662 with the DS-Replication-Get-Changes-All control access right GUID), Golden Ticket reuse (4769 with no preceding 4768 for the same TGT), Silver Ticket abuse (4624 on a service host with no corresponding 4769 on a DC), Skeleton Key (LSASS DLL injection signals in 4673 / 4674), DCShadow (Directory Service Changes), and password-spraying patterns. Operationally this is the difference between a SOC that can investigate an authentication anomaly in minutes and one that has to pull a memory image of LSASS to answer the same question. Compliance frameworks treat the advanced policy as the baseline: CIS Microsoft Windows Server 2022 benchmark section 17, NIST 800-53 AU-2 / AU-3 / AU-12, PCI DSS Requirement 10, and the Microsoft Security Compliance Toolkit baselines all assume subcategory-level configuration. Finally, attackers actively exploit log gaps: MITRE ATT&CK T1562.002 (Impair Defenses: Disable Windows Event Logging) is a documented technique used by APT41, FIN8, and Lazarus, and they target environments where audit policy is already weak because their tampering blends in with the existing noise floor.
Attack path
1. Initial recon: the operator lands on a member server with a low-privilege account and queries the effective audit policy with "auditpol /get /category:*". On a domain with ADLOG-001 failing, the output shows the nine legacy categories rather than the 60+ subcategories. This tells the operator that DC-side telemetry is coarse and that high-signal techniques will likely go undetected. 2. Kerberoasting (T1558.003): the operator requests TGS tickets for every account with a registered SPN using Rubeus kerberoast or Impacket GetUserSPNs.py. Each request emits Event 4769 on a DC, but without the Account Logon > Kerberos Service Ticket Operations subcategory enabled with Success auditing, the legacy "Audit account logon events" either does not produce these events or produces them without the ticket encryption type field, which is the load-bearing indicator (RC4-HMAC TGS for a user account is the canonical kerberoasting signature). 3. AS-REP roasting (T1558.004): the operator queries for accounts with DONT_REQ_PREAUTH set on userAccountControl and requests AS-REP responses without preauthentication using Rubeus asreproast. Without subcategory-level Kerberos Authentication Service auditing, the Pre-Authentication Type 0 field on Event 4768 is not reliably emitted. 4. DCSync (T1003.006): with appropriate replication rights the operator runs mimikatz lsadump::dcsync or secretsdump.py. The detection signature is Event 4662 on the Domain naming context with the DS-Replication-Get-Changes-All extended right GUID (1131f6ad-9c07-11d1-f79f-00c04fc2dcd2). Without DS Access > Directory Service Access subcategory auditing enabled, 4662 is not produced. 5. Log tampering (T1562.002, T1070.001): once persistence is established the operator can disable specific subcategories with auditpol /set, clear the Security log, or stop the EventLog service. Because the baseline was already coarse, the operations team does not detect the change. 6. Persistence and exfiltration proceed under cover of the logging gap. Post-incident, responders cannot reconstruct the attacker timeline from the Security log because the events they need (4769 with encryption type, 4662 with control access rights, 4673 sensitive privilege use) were never recorded.
How Guerrilla assesses it
Guerrilla resolves the SYSVOL path for the current domain (\\<domain FQDN>\SYSVOL\<domain FQDN>\Policies) and constructs the canonical path for the Default Domain Controllers Policy using its well-known GUID {6AC1786C-016F-11D2-945F-00C04FB984F9}. It then tests for the presence of Machine\Microsoft\Windows NT\Audit\audit.csv inside that GPO folder. The check uses a SYSVOL read rather than parsing the GPO over LDAP because audit policy is not stored as attributes on the GPC object: the Group Policy Client-Side Extension for Advanced Audit Policy is a file-based CSE that reads the CSV at apply time. The check additionally reads the GptTmpl.inf to detect whether "Audit: Force audit policy subcategory settings" (registry path HKLM\System\CurrentControlSet\Control\Lsa, value SCENoApplyLegacyAuditPolicy) is set to 1, because without that flag the legacy category settings take precedence and the advanced subcategories are silently ignored. The check is read-only and runs as any authenticated domain user (SYSVOL is world-readable by Authenticated Users by default). Output emits the policy path inspected, a Boolean for audit.csv presence, a Boolean for the force-subcategory flag, and a parsed enumeration of the subcategories declared in the CSV when present, so downstream checks (ADLOG-002 through ADLOG-007) can validate which specific subcategories and Success / Failure settings are configured.
Recommended value
Default Domain Controllers Policy ships an audit.csv (Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > <subcategories>).
Remediation
Open the Default Domain Controllers Policy in GPMC. Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies. Enable at minimum: Account Logon > Kerberos Service Ticket Operations (Success+Failure), Logon/Logoff > Logon (Success+Failure) + Special Logon (Success), Account Management > all (Success), Object Access > File Share + Detailed File Share (Success+Failure if monitoring lateral movement), Detailed Tracking > Process Creation (Success). Also enable 'Audit: Force audit policy subcategory settings' in Security Options so it takes precedence over the legacy nine-category settings.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| no-data | Not Assessed |
Framework mappings
- NIST SP 800-53
- AU-2, AU-3, AU-12
- CIS AD Benchmark
- 9.1.1
- MITRE ATT&CK
- T1562.002