Windows-itpro-docs: Detailed Tracking - Audit Token Right Adjusted

[cronq]

Win10 includes the Audit Token Right Adjusted subcategory in Detailed Tracking. Please update this page/create a subpage for Audit Token Right Adjusted.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 739bc932-12f0-9595-fbd2-d5b0df73fe93
• Version Independent ID: cd1f89ad-34db-bb96-e9ef-2137958c9403
• Content: Advanced security audit policy settings (Windows 10)
• Content Source: windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md
• Product: w10
• GitHub Login: @brianlic-msft
• Microsoft Alias: justinha

[cronq]

Any update on this?

[Justinha]

@cronq sorry for delay and thanks for the suggestion. I'm searching for a SME who can help. Our auditing docs were contributed by a SME who can no longer contribute. Can you share what problem you are trying to solve? I'll pass along what I find.

[cronq]

I guess mostly I'm trying to determine if it's appropriate to turn the auditing on in my environment. The level of detail on these pages is great including written description, recommendations for server vs workstation, and all the event IDs that are created when this auditing is turned on. Just looking for this missing part of the documentation to be added.

[fate0521]

It would be nice to see this page added since MS had already done a blog on it in regards to credential theft.

https://blogs.technet.microsoft.com/nathangau/2018/01/25/security-monitoring-a-possible-new-way-to-detect-privilege-escalation/

[mypil]

@officedocsbot assign @mypil

[Reeced40]

@cronq @fate0521 Thank you for the information, I will have the article updated soonest.

[mypil]

@cronq - Thank you for submitting feedback.

From our understanding, the issue has been resolved but it may take a few days for the merged content to appear in the article. If you feel it hasn't been resolved, please re-open this issue.

Thank you for your contribution to make the docs better! Much appreciated!

[mypil]

@officedocsbot close

[fate0521]

Thanks!

[cronq]

It's been 6 days and I don't see the update. Should I keep waiting?

[illfated]

Thank you for pointing that out. It is somewhat unusual to see the change not migrating to the public Docs page within 6 days after the merge, but in this case, we have to give it an extra day to see if the docs.microsoft.com page will update tomorrow or later today.

[cronq]

Well, it's been another couple days and no update is posted...

[mypil]

@cronq - The document content has been updated based on the changes added in the merged PR .

You can see the Note added under the Detailed Tracking section of the article.

[cronq]

I see. The reason I wasn't seeing it was because my request was for a linked page. Literally every other advanced audit policy has a separate page describing what it is, the event volume, audit recommendations for 'general' and 'stronger', and a list of event IDs (ok, some don't have all the details, but that all have at least a page to themselves). My 2 cents is create the linked page so the documentation is complete and add the blog as a reference inside of that page.

Also, as the note doesn't call out 'audit token right adjusted' you can't search for it on the page to understand the 'security monitoring' link has details on this setting.

[mypil]

@officedocsbot reopen

[mypil]

@cronq - Thanks for the clarification and additional inputs.

I'm reopening this issue and also discussed with @Reeced40 to help create another PR to incorporate your feedback.

[Reeced40]

@cronq Thank you for clarifying. Would this be the link that you would like added for the Audit Token Right Adjusted subcategory under Detailed Tracking? https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4703.

[mypil]

@cronq - Can you please respond to the query of Reeced40? Thank you.

[cronq]

No. See this page on Audit Credential Validation as a good example of the content that's missing for Audit Token Right Adjusted. One of the questions I have that would be answered by such a page is if event 4703 is the only event associated with enabling Audit Token Right Adjusted. Thus, your link above would be a link on the page I'm looking for.

[Reeced40]

@cronq Thanks, I'll add it to the article soonest.

[mypil]

@cronq - The content has been updated to add the changes that you requested for. However, it may take a few days for the merged content to reflect in the document. For your reference, please check on PR 3845 which contains the revision. Thank you.

[cronq]

I'll try and be more clear this time because PR 3845 doesn't hit the mark either. Line 65 of the PR should be this: Audit Token Right Adjusted

The problem is the page it should link to (https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-token-right-adjusted) does not exist and that's my point from the beginning. Someone needs to create the content.

[mypil]

@cronq - Your request would need the consideration and inputs from the author. Looping in @Justinha on this thread.
@Justinha - can you please share your insights on this?

Thank you.

[mypil]

@Justinha @DulceMontemayor - Can you please share your insights on this?

Thank you.

[mypil]

@cronq - For this additional feedback that you have in terms of creating the relevant content, kindly submit it via User Voice https://support.microsoft.com/en-za/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub

You might find others have made a similar request that you can add to, or you can open a new one.

Thank you for engaging with the community here for the docs.

[mypil]

@officedocsbot close

[illfated]

New PR added:
Add page for Audit Token Right Adjusted #4822

PR #4822 introduces the following new page for this issue: audit-token-right-adjusted.md
https://github.com/MicrosoftDocs/windows-itpro-docs/pull/4822/files?short_path=7384bba#diff-7384bba5d82f9a90a54d1fcab927a8d8
The new page replaces the external TechNet blog content.

[illfated]

... and the PR has been merged into the master branch now, 45 minutes ago (as of the time of this comment).