USB data transfer without user authentication, USB data transfer without authentication of the connecting system] enable/disable backup to [remote system] Windows Logs/Security: 4657 enable/disable [selection: Hotspot functionality authenticated by [selection: pre-shared key, passcode, no authentication], N/A USB tethering authenticated by [selection: pre-shared key, passcode, no authentication]] approve exceptions for sharing data between [selection: application processes, groups of application processes] N/A place applications into application process groups based on [assignment: application characteristics] N/A enable/disable location services: Windows Logs/Security: 4657 across device [ b. on a per-app basis c. no other method] [none] N/A Table 2: Administrative Actions audits Requirement Description Additional Record Contents Log: Event Id All modifications to the audit configuration that occur while the FAU_SEL.1 No additional Information. Windows Logs/Security: 4719 audit collection functions are operating. FCS_CKM_EXT.1 [generation of a REK] No additional Information. Windows Logs/System: 24 Windows Logs/System: FCS_CKM_EXT.5 Success or failure of the wipe. No additional Information. Success: 12 Failure: 4502 FCS_CKM.1(1) Failure of key generation activity for authentication keys. No additional Information. Microsoft-Windows-Crypto-NCrypt: 4 Applications and Services Logs -> Issuer Name and Subject Name of certificate. FCS_HTTPS_EXT.1 Failure of the certificate validity check. Microsoft -> Windows -> CAPI2 -> [No additional information]. Operational: 11 FCS_RBG_EXT.1 Failure of the randomization process. No additional information. Windows Logs -> System: 20 Import: Applications and Services Logs -> Microsoft -> Windows -> FCS_STG_EXT.1 Import or destruction of key. [No other events] Identity of key. Role and identity of requestor. 1006 Destruction: Windows Logs/System: 12
USB data transfer without user authentication, USB data transfer without authentication of the connecting system] enable/disable backup to [remote system] Windows Logs/Security: 4657 enable/disable [selection: Hotspot functionality authenticated by [selection: pre-shared key, passcode, no authentication], USB tethering authenticated by [selection: pre-shared key, passcode, no authentication]] N/A approve exceptions for sharing data between [selection: application processes, groups of application processes] N/A place applications into application process groups based on [assignment: application characteristics] N/A enable/disable location services: across device [ b. on a per-app basis c. no other method] Windows Logs/Security: 4657 [none] N/A Table 2: Administrative Actions audits Requirement Description Additional Record Contents Log: Event Id FAU_SEL.1 All modifications to the audit configuration that occur while the audit collection functions are operating. No additional Information. Windows Logs/Security: 4719 FCS_CKM_EXT.1 [generation of a REK] No additional Information. Windows Logs/System: 24 FCS_CKM_EXT.5 Success or failure of the wipe. No additional Information. Windows Logs/System: Success: 12 Failure: 4502 FCS_CKM.1(1) Failure of key generation activity for authentication keys. No additional Information. Microsoft-Windows-Crypto-NCrypt: 4 FCS_HTTPS_EXT.1 Failure of the certificate validity check. Issuer Name and Subject Name of certificate. [No additional information]. Applications and Services Logs -> Microsoft -> Windows -> CAPI2 -> Operational: 11 FCS_RBG_EXT.1 Failure of the randomization process. No additional information. Windows Logs -> System: 20 FCS_STG_EXT.1 Import or destruction of key. [No other events] Identity of key. Role and identity of requestor. Import: Applications and Services Logs -> Microsoft -> Windows -> 1006 Destruction: Windows Logs/System: 12