Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation · Policy appendix

Logging and auditing

Every setting of the “Logging and auditing” package with its effect, value and recommending sources.

since 0.9.8.11

Purpose

This page lists every setting of the “Logging and auditing” package: what it does, which value Setup Foundry sets and who recommends it. It is generated from the catalog and never edited by hand.

18 settings.

Notes

Specify the maximum log file size (KB)

This computer policy limits the maximum size of the Windows Application log file. MaxSize is a REG_DWORD value whose data represents the size in kilobytes.

Specify the maximum log file size (KB)

This computer policy limits the maximum size of the Windows Security log. MaxSize is a REG_DWORD value whose data represents the size in kilobytes.

Specify the maximum log file size (KB)

This computer policy limits the size of the file that stores the Windows System log. MaxSize is a REG_DWORD value whose data represents the maximum file size in kilobytes.

Include command line in process creation events

This setting adds the command line of a newly started process to process creation audit events. When the value is enabled, Windows records the executable name and its supplied arguments in the Process Command Line field of event 4688.

Windows Firewall: Private: Logging: Log dropped packets

This registry value controls logging for incoming network packets that Windows Defender Firewall drops under the private firewall profile. A DWORD value of 1 enables this logging.

Log dropped packets

This registry value controls logging for network packets dropped by Windows Firewall while the public firewall profile is active. It is a DWORD value: 1 enables dropped-packet logging, while 0 disables it.

Windows Firewall: Private: Logging: Log successful connections

A REG_DWORD value of 1 enables logging for connections allowed by Windows Firewall under the private network profile. Windows records these as ALLOW entries in the firewall log file used by that profile.

Windows Firewall: Public: Logging: Log successful connections

This registry value controls the logging of network connections allowed by Windows Firewall while the public network profile is in use. It is a REG_DWORD value; a value of 1 enables successful-connection logging.

Audit server does not support signing

The AuditServerDoesNotSupportSigning DWORD value enables SMB-client auditing for servers that do not support SMB signing. When the value is 1, the Windows SMB client records an audit event after detecting such a server. These events are written to the Microsoft-Windows-SMBClient/Audit log.

Audit server does not support encryption

Setting this REG_DWORD value to 1 enables an SMB client audit event when a contacted SMB server does not support SMB encryption.

Audit client does not support signing

This registry value controls auditing for SMB clients that do not support SMB signing. A value of 1 causes the SMB server to log an audit event when it detects such a client. With a value of 0, or when the value is absent, this specific event is not logged.

Audit client does not support encryption

A DWORD value of 1 enables server-side auditing of SMB clients that do not support SMB encryption. When the SMB server detects such a client, it records an audit event in the Microsoft\Windows\SMBServer\Audit log.

Windows Firewall: Private: Logging: Size limit (KB)

The LogFileSize value specifies the maximum size, in kilobytes, of the Windows Firewall log file for the private network profile. Its data type is REG_DWORD.

Windows Firewall: Public: Logging: Size limit (KB)

This DWORD value specifies the maximum size, in kilobytes, of the Windows Firewall log file for the public network profile. A value of 16384 limits the file to 16,384 KB, equivalent to 16 MB.

Turn on PowerShell Script Block Logging

Setting the EnableScriptBlockLogging DWORD value to 1 enables machine-wide script block logging for PowerShell 7. PowerShell records the content of processed commands, script blocks, functions, and scripts, whether they are submitted interactively or invoked through automation.

Turn on PowerShell Script Block Logging

These policy-backed registry values control script block logging in Windows PowerShell. Both values use the REG_DWORD data type.

Audit insecure guest logon

This value enables auditing of insecure guest logons by the SMB client. When the DWORD value is set to 1, Windows records an audit event when an SMB connection is allowed as an unauthenticated guest.

Audit insecure guest logon

This computer-scoped registry value controls server-side auditing of SMB guest logons. It is a DWORD value. When set to 1, the SMB server records an event whenever an SMB client logs on as the Guest account.

See also