Key Security Events for CJIS Compliance
Account Logon
Credential Validation
The computer attempted to validate the credentials for an account
Kerberos Authentication Service
This event generates every time Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT).
Kerberos pre-authentication failed
Kerberos Service Ticket Operations
A Kerberos service ticket was requested
Account Management
User Account Management
An attempt was made to change an account's password
An attempt was made to reset an account's password
Logon/Logoff
Logon
An account was successfully logged on
Logon, Account Lockout
An account failed to log on
Other Logon/Logoff Events
A replay attack was detected
Object Access
File System, Kernel Object, Registry, Removable Storage
A handle to an object was requested
An attempt was made to access an object
System
Other System Events
The audit log was cleared
Audit Policy Requirements
| Category | Subcategory | Audit Type |
|---|---|---|
| Account Logon | Credential Validation | Success, Failure |
| Object Access | File System, Kernel Object, Registry, Removable Storage | Success |
| Account Logon | Kerberos Authentication Service | Failure |
| Account Logon | Kerberos Service Ticket Operations | Success, Failure |
| Logon/Logoff | Logon | Success |
| Logon/Logoff | Logon, Account Lockout | Failure |
| Logon/Logoff | Other Logon/Logoff Events | Success, Failure |
| System | Other System Events | Success |
| Account Management | User Account Management | Success, Failure |