More security events in 2008 than 2003?

[jcochran]

I just noticed after adding a few 2008 R2 DCs that the volume of security events has drastically increased. Does anyone have any information or resources the outline the changes in the security log for 2008?

[ryansutton]

Server 2008 added more categories and sub categories for logging, which is why you are seeing more events.

[jcochran]

Thanks. Yes I'm aware of "why" my event logs are bigger, but I was curious if anyone knew if the changes were documented. I have an application that archives security logs and I need to filter appropriately.

[ryansutton]

http://technet.microsoft.com/en-us/library/dd560628(WS.10).aspx

[jcochran]

That describes the new 53 auditing categories which are turned off by default.

[jcochran]

Here is some good information that I found. While the 53 new audit categories are turned off by default, new audit sub-categories are added to existing 2003 categories. So if you have any of those audit categories enabled via Group Policy, you will notice more events.

http://www.ultimatewindowssecurity.com/wiki/WindowsSecuritySettings/OVERVIEW-Audit-Policy

http://www.ultimatewindowssecurity.com/wiki/WindowsSecuritySettings/Audit-Force-audit-policy-subcategory-settings-Windows-Vista-or-later-to-override-audit-policy-category