Securing Vista: Tips on conducting desktop audits

This article is excerpted from The Unofficial Guide to Microsoft Windows Vista, with permission of Wiley Publishing Inc., all rights reserved.

As one of the main pillars of security, auditing is perhaps the least known and overlooked. When a system crashes, most people reboot, hoping the problem is then sorted. However, Windows can be configured to audit just about anything that happens on its watch. This includes security issues and performance. This gives you some idea of what went wrong, and in the case of audit events, it provides a warning that unauthorized activity is afoot.

Auditing can be done for many things, but the two most connected to security are auditing access policies and auditing file usage. To audit access policies, you need to change some settings to the local computer's policies. This can be done using the Local Security Policy snap-in for standalone or workgroup computers, or using the Group Policy Editor for computers attached to a domain.

Determine effective group policies

If you are running Windows Vista over a domain, the administrator can apply policies at various levels. These include domain, unit, computer, use and your local computer. The problem with policies and having so many different levels is that the user can easily become confused, not to mention that it is not uncommon for policies to be in conflict, or indeed contradictory! Fortunately, Microsoft recognized how unpleasant going through all of the policies can be, so they gave us an MMC snap-in to help things out. The Resultant Set of Policy snap-in provides a more extensive look at which policies are being applied and where they came from.

To install it, simply

1. Open mmc from the Start menu search box.
2. Use the Add/Remove Snap-in menu to add this snap-in. After it is installed, right-click the snap-in and select Generate RSoP data. The Resultant Set of Policy Wizard appears. 
3. Click Next and then select Logging mode and click Next again. 
4. Select This computer and then click Next.
5.  Select Current user and then click Next.
6. Review the selection summary before clicking Next.
7. Click Finished at the end of the wizard.
   1

   2

   3

   Next page