Windows-itpro-docs: Duplicate link for advanced audit policy

[tp-seiso]

The Account Logon and Logon/Logoff sections both refer to the same Audit Other Logon/Logoff Events page.

A review of the Audit Policy in the group policy manager indicates that the Account Logon category should actually refer to an Audit Other Account Logon Events subcategory that appears to be undocumented in this repository. The Logon/Logoff category actually has the subcategory referred to in both places in the documentation.

A Word document with similar information is found here and corroborates the Group Policy configuration that I reviewed prior to opening this issue.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 739bc932-12f0-9595-fbd2-d5b0df73fe93
• Version Independent ID: cd1f89ad-34db-bb96-e9ef-2137958c9403
• Content: Advanced security audit policy settings (Windows 10)
• Content Source: windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md
• Product: w10
• Technology: windows
• GitHub Login: @Dansimp
• Microsoft Alias: dansimp

[tp-seiso]

It appears that there is a document for Audit Other Account Logon Events that should be added to the Account Logon section in place of the duplicate

[jvsam]

@officedocsbot assign @jvsam

[illfated]

@tp-seiso : Just to clarify a detail in your link in comment https://github.com/MicrosoftDocs/windows-itpro-docs/issues/5345#issuecomment-549165105

[ ... ] there is a document for Audit Other Account Logon Events [ ... ]
https://github.com/MicrosoftDocs/windows-itpro-docs/blob/dc357e25809bb2b6a9ac9943b6d0699612d26b81/windows/security/threat-protection/auditing/audit-other-account-logon-events.md

That is basically the same page as
https://github.com/MicrosoftDocs/windows-itpro-docs/blob/public/windows/security/threat-protection/auditing/audit-other-account-logon-events.md
(This auditing subcategory does not contain any events. It is intended for future use.)

I may get back to this later, if needed, because I don't have easy access to my workplace domain environment at this very moment.

[tp-seiso]

@illfated - thanks for the reply! I think you're correct that those links point to the same doc which indicates that there are no events and the category is for future use.

The issue that I'm reporting is that the document you linked to is _not_ linked to from the Advanced security audit policy settings document. Either of the links you posted should be included under the Account Logon section instead of the existing Audit Other Logon/Logoff Events link.

[illfated]

Aha. It took me a while to effectively draw the mental line between them and compare the docs.microsoft.com page with the github.com/MicrosoftDocs/windows-itpro-docs/ page.

https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-logonlogoff-events
vs.
https://github.com/MicrosoftDocs/windows-itpro-docs/blob/public/windows/security/threat-protection/auditing/audit-other-account-logon-events.md

These 2 links should in theory have been the same page, minus the web page framework and menu system on docs.microsoft.com .
Some times, there are extra pieces included in the docs.microsoft.com pages, I am not quite sure how it is indicated here on Github.

[tp-seiso]

Thanks for continuing to look into it and tracking down those different pages.

The thing that confused me the most was how similar the names of the subcategories are. The Account Logon heading should be changed to have an item called Audit Other Account Logon Events. The Logon/Logoff heading should be the only heading to have the item called Audit Other Logon/Logoff Events.

[jvsam]

Hi @tp-seiso, thank you for bringing this to our attention. Your feedback is appreciated.

Thanks as well @illfated for engaging with the community.

Are you suggesting that we replace the 'Audit Other Logon/Logoff Events' link under Account Logon with Audit Other Account Logon Events? Thanks for the clarification.

[illfated]

I am planning to make an effort during the weekend to sum up the suggested changes and create a PR based on this. Feel free to add more comments here on this page, regarding your view of how this needs to be done.

[jvsam]

@illfated I'm not quite familiar with this topic so I'll defer to you :-) We can then have the author review it for accuracy. Looking forward to your PR. Thank you.

[illfated]

My weekend did not go quite as planned, so I ended up with far less time left to look into this issue. I will get back to this during the weekdays or as soon as I don't get sidetracked by other activities.

[jvsam]

Hi @illfated do you have time to look into this issue again and propose the amendments? Only if you are not busy. Thank you.

[illfated]

Thank you for reminding me. There should be less things occupying my free time now, seeing that most of my existing PRs have been well followed up and merged into the public branch. My conscience is not as good as it should have been when it comes to missing my follow-up on this issue ticket.

I will do my best to get started on this tomorrow. Thank you.

[jvsam]

Hi @illfated, do you still have the capacity to create the PR with the suggestions, considering the upcoming holidays? Regards!

[illfated]

Well, I won't be doing much in the holidays, so I should be able to. It is just a matter of getting my mindset back to the state where I remember the back and forth of these pages and the links. I'm sorry for the delay, I just get so easily distracted to concentrate on getting the mental image back in my mind of how it should look. Thank you again for asking. I do want to get it done, I just struggle a bit with keeping my focus on this long enough to complete it.

[nam31]

Closing via merged PR #8447. Thank you.