3

Something (or someone) keeps changing our environment path variables on several of our servers. I have the Audit Policy (under local sec pol) set to Success, Failure for all but Process Tracking (which is just failure). However, when changes are made to our environment path, I'm not able to find where the audit log of the change is being logged.

Can someone point me in the direction where I would find the path environment variable change log (or how to enable auditing for environment path changes, if not already)?

I'm on Windows Server 2012 Standard.

John S.
  • 141
  • 1
  • 5

1 Answers1

0

The machine path variable is stored in the registry at:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\Path

user variables are under:

HKEY_CURRENT_USER\Environment

To audit objects in Windows to have to do two things.

First turn auditing on, which you already did.

it should be enough to enable: Success for Audit object access

Secondly, you have to change the object which you want to audit.

In regedit.exe navigate to the key mentioned above.

Select Permissions from the Edit menu. Click the Advanced button and then the Auditing tab.

Click the Add button and then the Select a principal link, type Everyone and click OK.

Tick Full Control and three times OK

Now access to that registry key is audited. To look at the audit you use the Security log in Event Viewer

It should tell you: user, process, time and even the new value.

When you don't need the auditing anymore, you should turn it off again.

Peter Hahndorf
  • 14,058
  • 3
  • 41
  • 58