Examkin

Question

Difficulty: HardWindows Administrative and System Management Tools

A security administrator needs to audit unauthorized file access attempts on a confidential folder stored on a Windows 11 Pro workstation. The administrator must enable system-wide object access auditing, configure the target folder's access control list, and verify that failed attempts generate entries in the Security log. Place the administrative steps in the correct order required to accomplish this configuration.

  1. 1Open Local Security Policy (secpol.msc) with administrative privileges.
  2. 2Navigate to Local Policies > Audit Policy and set 'Audit object access' to log 'Failure' events.
  3. 3Open File Explorer, access the properties of the confidential folder, and navigate to Security > Advanced > Auditing tab.
  4. 4Add an auditing entry for the 'Everyone' principal and select the 'Fail' type for Read and Execute permissions.
  5. 5Open Event Viewer (eventvwr.msc) and inspect the Windows Logs > Security log for Audit Failure events (Event ID 4656/4663).

Answer

The correct sequence starts with opening Local Security Policy (secpol.msc), enabling Failure auditing under Local Policies > Audit Policy > Audit object access, navigating to the folder's Advanced Security settings Auditing tab in File Explorer, defining a SACL entry for 'Everyone' with Fail permissions, and finally verifying generated Audit Failure records within Event Viewer's Security log.
Configuring object access auditing in Windows requires a top-down administrative workflow. First, the administrator must enable the global auditing engine by launching Local Security Policy (secpol.msc) and enabling Failure auditing under Local Policies > Audit Policy > Audit object access. Second, the administrator must target the specific file system resource by opening the folder properties in File Explorer, accessing Advanced Security settings, and creating a System Access Control List (SACL) entry for the target group (e.g., Everyone) with Type set to Fail for Read/Execute permissions. Third, the administrator validates the implementation by checking Event Viewer (eventvwr.msc) under Windows Logs > Security to inspect generated Audit Failure events.

Step-by-Step Solution

1
Launch the Local Security Policy console (secpol.msc).
The Local Security Policy management window opens.
Global auditing capabilities in Windows are managed centrally through local security policies.
2
Navigate to Security Settings > Local Policies > Audit Policy, open 'Audit object access', and enable the 'Failure' checkbox.
The OS is instructed to track failed attempts to access objects that possess SACL auditing entries.
Without enabling global object access auditing, configuring auditing on individual folders will have no effect.
3
Open File Explorer, right-click the target folder, choose Properties, select the Security tab, and click Advanced.
The Advanced Security Settings dialog box for the folder opens.
NTFS object auditing requires configuring the object's System Access Control List (SACL) via the Auditing tab.
4
Switch to the Auditing tab, click Add, specify the principal 'Everyone', set Type to 'Fail', and check Read & execute permissions.
A SACL rule is attached to the folder monitoring failed access attempts.
This specific rule links user access failures on this folder to the system audit mechanism.
5
Launch Event Viewer (eventvwr.msc) and navigate to Windows Logs > Security.
The Security log presents generated audit entries including Event ID 4656/4663 Audit Failures.
Event Viewer allows administrators to review and verify that security event logs are actively recording access failures.

Key Concept

Configuring Object Access Auditing in Windows via Local Security Policy (secpol.msc), File Explorer SACL Properties, and Event Viewer (eventvwr.msc)
Estimated Time:2m 0s
Rate this question

Topics

Windows Administrative and System Management Tools

More questions from this topic