Auditing permissions (Windows)

Module: Registry

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option reports a problem if auditing permissions (or System ACLs) do not match the values in their associated template records.

The following table lists the error messages for the check.

Table: Error messages for Auditing permissions

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_DIFFERENT_SACL_ENTRY

Category: System Information

  • Windows 2000 (106747)

  • Windows 2003 (206747)

  • Windows 2008 (249747)

  • Windows Vista (229747)

  • Windows XP (201747)

Title: Incorrect auditing settings

Description:The key's auditing settings for the user do not match the template. Change the settings to match the template or update the template manually.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Account: %s; type: %s; events audited: %s; expected: %s]

String ID: ESM_MISSING_SACL_ENTRY

Category: System Information

  • Windows 2000 (106748)

  • Windows 2003 (206748)

  • Windows 2008 (249748)

  • Windows Vista (229748)

  • Windows XP (201748)

Title: Key not audited for account

Description:The key is not audited for the account as specified in the template. Update the auditing settings to match the template or remove the account's entry from the Auditing sublist.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Account: %s]

String ID: ESM_ADDITIONAL_SACL_ENTRY

Category: System Information

  • Windows 2000 (106749)

  • Windows 2003 (206749)

  • Windows 2008 (249749)

  • Windows Vista (229749)

  • Windows XP (201749)

Title: Auditing settings exceed policy

Description:The key is audited for the account. The template specifies no auditing settings on this key for the account. Update the auditing settings to match the template or remove the account's entry from the Auditing sublist.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Account: %s; success events: %s; failure events: %s]

String ID: ESM_CANNOT_GET_AUDITING_INFO

Category: System Information

  • Windows 2000 (106752)

  • Windows 2003 (206752)

  • Windows 2008 (249752)

  • Windows Vista (229752)

  • Windows XP (201752)

Title: Auditing ACL not checked

Description:The key's auditing settings could not be read for the reason that is reported in the Information field. Review the auditing settings for this key in the registry.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Error: %s]

String ID: ESMT_AUDIT_DISABLED_ACCOUNTS

Category: System Information

  • Windows 2000 (106764)

  • Windows 2003 (206764)

  • Windows 2008 (249764)

  • Windows Vista (229764)

  • Windows XP (201764)

Title: Disabled Accounts in Auditing permissions

Description:List of disabled accounts in Auditing permissions.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]