Audit Policy settings for PCI Compliance

Audit Policy configuration required for PCI Compliance
KB1337 | Last review: Aug 16, 2017 | Netwrix Auditor for Windows Server | All versions
Email It to Me Print this Page
This article describes the audit policiy required for PCI Compiance.

The following Audit Policy is required for PCI Compliance:
  • Account Logon Events – Success and Failure
  • Account Management Events – Success and Failure
  • Directory Service Access Events – Failure
  • Logon Events – Success and Failure
  • Object Access Events – Success and Failure
  • Policy Change Events – Success and Failure
  • Privilege Use Events - Failure
  • Process Tracking – No Auditing
  • System Events – Success and Failure

Directory Service Access Events available on a Domain Controller only.
Object Access – Used in conjunction with Folder and File Auditing. Auditing Failures reveals attempted access to forbidden secure objects which may be an attempted security breach. Auditing Success is used to provide an Audit Trail of all access to secured data, for example, card data in a settlement/transaction file/folder.

We recommend to use Netwrix File Server Change Reporter to monitor the files changes, do not enable this audit policy for Event Log Manager.
NOTE: when using Windows Server 2008 / Windows 7 or later, there is an ‘Advanced Audit Policy Configuration’ option available which allows more precise application of auditing of Object Access events and is useful in eliminating unwanted events. If available, enable the ‘Audit File System’ option only for Success, and optionally Failure, but leave other settings as ‘Not Configured’

Process Tracking – not recommended as this will generate a large number of events.

We recommend to configure the following policies and to leave the other policies as is:
  • System Events – Success and Failure
  • Policy Change Events – Success and Failure
  • Account Management Events – Success and Failure
  • Account Logon Events – Success and Failure
  • Logon Events – Success and Failure
  • Privilege Use – No auditing
Was this information helpful?