Vista Custom Audit Policy

[RyanFerreri]

Hey all!!

So Vista has some snazzy new granular audit policies the you can set, but I would like to apply them with a GPO. Unfortunately, the process for doing this involves a machine startup script and scheduled tasks and the auditpol.exe tool. See here:

http://support.microsoft.com/kb/921469

It seems to me that this is a pretty messed up way to enforce a policy. Microsoft's take on it is that the values are stored in a binary key in HKLM\Security, and that it's not configurable with a GPO (so use the script).

Has anyone else messed around with this? If so, do you have any ideas? I already tried just exporting the values, but the value types are REG_NONE and I'd have to do a fair amount of research to figure out how to apply that type of value in an ADM(X).

Thanks!

I wrote about this in the upcoming book; but .. what new auditing stuff did you see that you wanted to use?

In other words, once you enable it; what are you planning on doing with it?

Just curious.