Insertion or removal of removable media Microsoft- Windows-Kernel-PnP/Device Configuration: 410 Establishment of a synchronizing connection System: 36880 Microsoft-Windows-CAPI2/Operational: 11 Specifically defined auditable events from table 10 <see second table below> Audit records reaching [assignment: integer value less than 100] percentage of audit capacity, [assignment: other auditable events derived from Security: 1103 this profile Table 1: FAU_GEN.1 audits (AGD1: FAU_GEN.1) The following table correlates the set of administrative operations described in this document with their associated audits. Section FMT_SMF_EXT.1 has test procedures to produce these audits. Administrative Action Id configure password policy: IT Administrator: minimum password length minimum password complexity 813 maximum password lifetime Local Administrator: Security: 4739 configure session locking policy: IT Administrator: screen-lock enabled/disabled screen lock timeout 813 number of authentication failures Local Administrator: Security: 4739 enable/disable the VPN protection: Security: across device Enable: 4651, 5451 [b. on a per-app basis Disable: 4655 c. no other method] enable/disable [GPS, Wi-Fi, Bluetooth, mobile broadband] 813
Insertion or removal of removable media Microsoft- Windows-Kernel-PnP/Device Configuration: 410 Establishment of a synchronizing connection System: 36880 Microsoft-Windows-CAPI2/Operational: 11 Specifically defined auditable events from table 10 <see second table below> Audit records reaching [assignment: integer value less than 100] percentage of audit capacity, [assignment: other auditable events derived from this profile Security: 1103 Table 1: FAU_GEN.1 audits (AGD1: FAU_GEN.1) The following table correlates the set of administrative operations described in this document with their associated audits. Section FMT_SMF_EXT.1 has test procedures to produce these audits. Administrative Action Id configure password policy: minimum password length minimum password complexity maximum password lifetime IT Administrator: 813 Local Administrator: Security: 4739 configure session locking policy: screen-lock enabled/disabled screen lock timeout number of authentication failures IT Administrator: 813 Local Administrator: Security: 4739 enable/disable the VPN protection: across device [b. on a per-app basis c. no other method] Security: Enable: 4651, 5451 Disable: 4655 enable/disable [GPS, Wi-Fi, Bluetooth, mobile broadband] 813
Windows%2010%20AU%20Operational%20Guidance%20(16%20Mar%202017)(clean).docx