Audit registry access or modification

Question

I want to audit registry modifications, or attempts in case of failure. For that purpose, I have set the audit policy as follows:

auditpol /set /subcategory:"Registry" /success:enable /failure:enable

However, even if I modify the registry, or attempt to modify keys where I don't have modification permission, I am not able to see any logs in the Event Viewer, under Security log.

The user I am setting the policy with, and then editing the registry is a Local Administrator user. The computer is not member of a domain.

What am I missing here?

Answer 1

Apparently, apart of setting the audit policy, it is necessary to explicitly set the registry keys we want to audit through their ACL.

In case we want to automate this setting it can be done using PowerShell as follows:

    $key = "HKLM:\System\" # the key we want to audit
    $sid = New-Object System.Security.Principal.SecurityIdentifier("S-1-1-0") # User, in this case "Everyone"
    $RegKey_ACL = Get-Acl $key
    $AccessRule = New-Object System.Security.AccessControl.RegistryAuditRule($sid,"SetValue,CreateSubKey,Delete","ObjectInherit,ContainerInherit","none","Success,Failure")
    $RegKey_ACL.AddAuditRule($AccessRule)
    $RegKey_ACL | Set-Acl $key