Exam MD-100 topic 3 question 10 discussion

That's right. B,D. Audit Sensitive Privilege has the option Take ownership of files or other objects, but it does not generate a event stating that the file's owner has been changed. It generates an event when an attempt was made to perform privileged system service operations. So it doesn't generate a event with owner change information. The audit file system has the log 4670(S): Permissions on an object were changed, This event generates when the permissions for an object are changed. The object could be a file system, registry, or security token object. And this event only appears when the audit file system is used. Look on descritions of the event that each generate. https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-file-system https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-sensitive-privilege-use https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4670

D. From a Group Policy object (GPO), configure the Audit File System setting. You can use Group Policy to configure the "Audit File System" setting to enable auditing of file and folder access on the Windows 10 computer. This will allow you to log any changes made to the files and folders, including changes in ownership. To do this, follow these steps: 1. Open the Group Policy Management Console. 2. Create or select a Group Policy Object that applies to the Windows 10 computer. 3. Navigate to "Computer Configuration" > "Windows Settings" > "Security Settings" > "Advanced Audit Policy Configuration" > "Audit Policies" > "Object Access". 4. Double-click on the "Audit File System" policy setting. 5. Select the "Success" option to audit successful file and folder access. 6. Click on the "OK" button to save the changes.

Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies - Local Group Policy Object > Privilege Use > Audit Sensitive Privilege Use