Enabling Windows Registry Events Auditing for Remote Registry Key Access

To enable auditing of Windows Registry events when a user opens a registry key through the Remote Registry service (accessed via a named pipe winreg), you can follow these steps:

1. Open Local Group Policy Editor:

   • Press Win + R and type gpedit.msc then press Enter.
   • If you don't have Local Group Policy Editor, you can use the Registry Editor (regedit).

2. Navigate to:

   • For Local Group Policy Editor:

     Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy
     

   • For Registry Editor:

     HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AuditPolicy
     

3. Set the following auditing policies:

   • Audit Object Access: Enabled
   • Audit Process Tracking: Enabled
   • Audit Account Logon Events: Enabled

4. To audit Registry access, create a new registry key:

   • For Local Group Policy Editor:

     Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment
     

   • For Registry Editor:

     HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
     

5. Create a new DWORD value named EnableLUA and set its value to 1.

6. To audit Remote Registry access, create a new registry key:

   • For Local Group Policy Editor:

     Computer Configuration > Administrative Templates > System > Remote Registry
     

   • For Registry Editor:

     HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry\Parameters
     

7. Set the Security Events policy to Enabled.

8. Restart the Remote Registry service:

   • Press Win + R and type services.msc then press Enter.
   • Find Remote Registry, right-click and select Restart.

Now, when a user opens a registry key through the Remote Registry service (accessed via a named pipe winreg), auditing will be enabled, and the related events will be recorded in the Security Event Log.

References:

• Books:

  • Microsoft Windows Server 2012 R2 Inside Out, Microsoft Press, 2013.
  • Windows Server 2016 Inside Out, Microsoft Press, 2016.

• Articles:

  • How to Audit Registry Access in Windows Server 2012 R2
  • How to Enable Auditing on Remote Registry in Windows Server 2012 R2

• Online Resources:

  • Microsoft TechNet: Auditing Registry Access
  • Microsoft TechNet: Remote Registry Service