Whose permissions are being used?

Question

Regarding "Permissions" in Windows, is it possible to trace or determine "who" is actually changing something? (i.e., determine what user is modifying something with their respective permissions)

For example, Process Monitor can see that certain registry keys are being accessed and set, but is it also possible to determine who (what user) was doing the accessing/altering?

I'm trying to track down the precise user account that's changing something, rather than willy-nilly locking down the various accounts in the permissions table through trial-and-error.

Answer 1

Using the regedt32.exe utility it is possible to set auditing on certain parts of the registry.

• Start the registry editor (regedt32.exe)
• Select the key you wish to audit (e.g. HKEY_LOCAL_MACHINE\Software) From the Security menu select Auditing
• Check the "Audit Permission on Existing Subkeys" if you want subkeys to also be audited
• Click the Add button and select the users you want to be audited, click Add and then click OK
• Once there are names in the "Names" box you can select which events to be audited, whether success or failure.
• When you have filled in all the information click OK

You will need to make sure that Auditing for File and Object access is enabled (use User Manager - Polices - Audit).

To view the information use Event Viewer and look at the Security information.

There is a Microsoft support article that explains how to set up Auditing. It uses the Local Policy Editor, which is not available on Windows 7 Home.