AzPolicyAdvertizer

last sync: 2025-Jul-03 17:22:55 UTC

Windows machines should meet requirements for 'System Audit Policies - System'

Azure BuiltIn Policy definition

-Source
+ Azure Portal
-Display name
+Windows machines should meet requirements for 'System Audit Policies - System'
-Id
+fa92-d69c-4810-8124-62414f560dcf
-Version
+.0.0
  Details on versioning
-Versioning
+                        Versions supported for Versioning: 1
3.0.0
                         Built-in Versioning [Preview]
-Category
+Guest Configuration
 Microsoft Learn
-Description
+Windows machines should have the specified Group Policy settings in the category 'System Audit Policies - System' for auditing IPsec driver, system integrity, system extension, state change, and other system events. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol.
-Cloud environments
+AzureCloud = true
AzureUSGovernment = true
AzureChinaCloud = unknown
-Available in AzUSGov
+The Policy is available in AzureUSGovernment cloud. Version: '2.0.0'
 Repository: Azure-Policy 8316fa92-d69c-4810-8124-62414f560dcf
-Mode
+Indexed
-Type
+BuiltIn
-Preview
+                False
-Deprecated
+False
-Effect
+                Default
AuditIfNotExists

                Allowed
AuditIfNotExists, Disabled
-RBAC role(s)
+                            none
-Rule aliases
+IF (7)


                    
                        Alias
                        Namespace
                        ResourceType
                        Path
                        PathIsDefault
                        DefaultPath
                        Modifiable
                    
                            
                                Microsoft.Compute/imageOffer
                                Microsoft.Compute
Microsoft.Compute
Microsoft.Compute
                                virtualMachines
virtualMachineScaleSets
disks
                                properties.storageProfile.imageReference.offer
properties.virtualMachineProfile.storageProfile.imageReference.offer
properties.creationData.imageReference.id
                                True
True
True
                                


                                False
False
False
                            
                            
                                Microsoft.Compute/imagePublisher
                                Microsoft.Compute
Microsoft.Compute
Microsoft.Compute
                                virtualMachines
virtualMachineScaleSets
disks
                                properties.storageProfile.imageReference.publisher
properties.virtualMachineProfile.storageProfile.imageReference.publisher
properties.creationData.imageReference.id
                                True
True
True
                                


                                False
False
False
                            
                            
                                Microsoft.Compute/imageSKU
                                Microsoft.Compute
Microsoft.Compute
Microsoft.Compute
                                virtualMachines
virtualMachineScaleSets
disks
                                properties.storageProfile.imageReference.sku
properties.virtualMachineProfile.storageProfile.imageReference.sku
properties.creationData.imageReference.id
                                True
True
True
                                


                                False
False
False
                            
                            
                                Microsoft.Compute/virtualMachines/osProfile.windowsConfiguration
                                Microsoft.Compute
                                virtualMachines
                                properties.osProfile.windowsConfiguration
                                True
                                
                                True
                            
                            
                                Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType
                                Microsoft.Compute
                                virtualMachines
                                properties.storageProfile.osDisk.osType
                                True
                                
                                True
                            
                            
                                Microsoft.ConnectedVMwarevSphere/virtualMachines/osProfile.osType
                                Microsoft.ConnectedVMwarevSphere
                                virtualmachines
                                properties.osProfile.osType
                                True
                                
                                False
                            
                            
                                Microsoft.HybridCompute/imageOffer
                                Microsoft.HybridCompute
                                machines
                                properties.osName
                                True
                                
                                False
                            
                    THEN-ExistenceCondition (2)

                    
                                        
                        Alias
                        Namespace
                        ResourceType
                        Path
                        PathIsDefault
                        DefaultPath
                        Modifiable
                    
                                                
                                Microsoft.GuestConfiguration/guestConfigurationAssignments/complianceStatus
                                Microsoft.GuestConfiguration
                                guestConfigurationAssignments
                                properties.complianceStatus
                                True
                                
                                False
                            
                            
                                Microsoft.GuestConfiguration/guestConfigurationAssignments/parameterHash
                                Microsoft.GuestConfiguration
                                guestConfigurationAssignments
                                properties.parameterHash
                                True
                                
                                False
-Alias
+Modifiable
-Microsoft.Compute/imageOffer
+False
False
False
-Microsoft.Compute/imagePublisher
+False
False
False
-Microsoft.Compute/imageSKU
+False
False
False
-Microsoft.Compute/virtualMachines/osProfile.windowsConfiguration
+True
-Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType
+True
-Microsoft.ConnectedVMwarevSphere/virtualMachines/osProfile.osType
+False
-Microsoft.HybridCompute/imageOffer
+False
-Alias
+Modifiable
-Microsoft.GuestConfiguration/guestConfigurationAssignments/complianceStatus
+False
-Microsoft.GuestConfiguration/guestConfigurationAssignments/parameterHash
+False
-Rule resource types
+                IF (3)

                                    Microsoft.Compute/virtualMachines
                    Microsoft.ConnectedVMwarevSphere/virtualMachines
                    Microsoft.HybridCompute/machines
-Compliance
+                    Not a Compliance control
-Initiatives usage
+Rows: 1-1 / 1
Records: Use the filters above each column to filter and limit table data. Advanced searches can be performed by using the following operators: 
<, <=, >, >=, =, *, !, {, }, ||,&&, [empty], [nonempty], rgx:
Learn more
TableFilter v0.7.3
https://www.tablefilter.com/
©2015-2025 Max GuglielmiClose
?
 Page  of 1
                            
                                

                                    Initiative DisplayName
                                    Initiative Id
                                    Initiative Category
                                    State
                                    Type
                                    polSet in AzUSGov
                                
                            
                            
                                [Preview]: Windows machines should meet requirements for the Azure compute security baseline
                                be7a78aa-3e10-4153-a5fd-8c6506dbc821
                                Guest Configuration
                                Preview                                     BuiltIn
                                    true
                            
                        
No results
-Initiative DisplayName
+polSet in AzUSGov
-[Preview]: Windows machines should meet requirements for the Azure compute security baseline
+true
-History
+                                Date/Time (UTC ymd) (i)
                                Change type
                                Change detail
                            
                                                    
                                2022-01-28 17:51:01
                                change
                                Major (2.0.0 > 3.0.0)
                            
                            
                                2020-09-15 14:06:41
                                change
                                Previous DisplayName: [Preview]: Windows machines should meet requirements for 'System Audit Policies - System' 
                            
                            
                                2020-08-20 14:05:01
                                add
                                8316fa92-d69c-4810-8124-62414f560dcf
-Date/Time (UTC ymd) (i)
+Change detail
--01-28 17:51:01
+Major (2.0.0 > 3.0.0)
--09-15 14:06:41
+Previous DisplayName: [Preview]: Windows machines should meet requirements for 'System Audit Policies - System'
--08-20 14:05:01
+fa92-d69c-4810-8124-62414f560dcf
-JSON compare
+    "mode": "Indexed",
@@ -4,9 +4,9 @@
     "mode": "Indexed",
     "description": "Windows machines should have the specified Group Policy settings in the category 'System Audit Policies - System' for auditing IPsec driver, system integrity, system extension, state change, and other system events. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol.",
     "metadata": {
         "category": "Guest Configuration",
-        "version": "2.0.0",
         "requiredProviders": [
             "Microsoft.GuestConfiguration"
         ],
         "guestConfiguration": {
@@ -21,9 +21,10 @@
         "IncludeArcMachines": {
             "type": "String",
             "metadata": {
                 "displayName": "Include Arc connected servers",
-                "description": "By selecting this option, you agree to be charged monthly per Arc connected machine."
             },
             "allowedValues": [
                 "true",
                 "false"
@@ -111,9 +112,9 @@
                                             "equals": "microsoft-dsvm"
                                         },
                                         {
                                             "field": "Microsoft.Compute/imageOffer",
-                                            "equals": "dsvm-windows"
                                         }
                                     ]
                                 },
                                 {
@@ -225,14 +226,34 @@
                             "value": "[parameters('IncludeArcMachines')]",
                             "equals": "true"
                         },
                         {
-                            "field": "type",
-                            "equals": "Microsoft.HybridCompute/machines"
-                        },
-                        {
-                            "field": "Microsoft.HybridCompute/imageOffer",
-                            "like": "windows*"
                         }
                     ]
                 }
             ]
     "mode": "Indexed",
     "description": "Windows machines should have the specified Group Policy settings in the category 'System Audit Policies - System' for auditing IPsec driver, system integrity, system extension, state change, and other system events. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol.",
     "metadata": {
         "category": "Guest Configuration",
+        "version": "3.0.0",
         "requiredProviders": [
             "Microsoft.GuestConfiguration"
         ],
         "guestConfiguration": {
         "IncludeArcMachines": {
             "type": "String",
             "metadata": {
                 "displayName": "Include Arc connected servers",
+                "description": "By selecting this option, you agree to be charged monthly per Arc connected machine.",
+                "portalReview": "true"
             },
             "allowedValues": [
                 "true",
                 "false"
                                             "equals": "microsoft-dsvm"
                                         },
                                         {
                                             "field": "Microsoft.Compute/imageOffer",
+                                            "like": "dsvm-win*"
                                         }
                                     ]
                                 },
                                 {
                             "value": "[parameters('IncludeArcMachines')]",
                             "equals": "true"
                         },
                         {
+                            "anyOf": [
+                                {
+                                    "allOf": [
+                                        {
+                                            "field": "type",
+                                            "equals": "Microsoft.HybridCompute/machines"
+                                        },
+                                        {
+                                            "field": "Microsoft.HybridCompute/imageOffer",
+                                            "like": "windows*"
+                                        }
+                                    ]
+                                },
+                                {
+                                    "allOf": [
+                                        {
+                                            "field": "type",
+                                            "equals": "Microsoft.ConnectedVMwarevSphere/virtualMachines"
+                                        },
+                                        {
+                                            "field": "Microsoft.ConnectedVMwarevSphere/virtualMachines/osProfile.osType",
+                                            "like": "windows*"
+                                        }
+                                    ]
+                                }
+                            ]
                         }
                     ]
                 }
             ]
-JSON
+                                api-version=2021-06-01

                                  EPAC
                                
                            
                        
                        
                            
                                {7 itemsdisplayName: "Windows machines should meet requirements for 'System Audit Policies - System'",
policyType: "BuiltIn",
mode: "Indexed",
description: "Windows machines should have the specified Group Policy settings in the category 'System Audit Policies - System' for auditing IPsec driver, system integrity, system extension, state change, and other system events. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol.",
metadata: {4 itemscategory: "Guest Configuration",
version: "3.0.0",
requiredProviders: [1 item"Microsoft.GuestConfiguration"
],
guestConfiguration: {3 itemsname: "AzureBaseline_SystemAuditPoliciesSystem",
version: "1.*",
configurationParameter: {1 itemAuditOtherSystemEvents: "Audit Other System Events;ExpectedValue"
}
}
},
parameters: {3 itemsIncludeArcMachines: {4 itemstype: "String",
metadata: {3 itemsdisplayName: "Include Arc connected servers",
description: "By selecting this option, you agree to be charged monthly per Arc connected machine.",
portalReview: "true"
},
allowedValues: [2 items"true",
"false"
],
defaultValue: "false"
},
AuditOtherSystemEvents: {4 itemstype: "String",
metadata: {2 itemsdisplayName: "Audit Other System Events",
description: "Specifies whether audit events are generated for Windows Firewall Service and Windows Firewall driver start and stop events, failure events for these services and Windows Firewall Service policy processing failures."
},
allowedValues: [4 items"No Auditing",
"Success",
"Failure",
"Success and Failure"
],
defaultValue: "No Auditing"
},
effect: {4 itemstype: "String",
metadata: {2 itemsdisplayName: "Effect",
description: "Enable or disable the execution of this policy"
},
allowedValues: [2 items"AuditIfNotExists",
"Disabled"
],
defaultValue: "AuditIfNotExists"
}
},
policyRule: {2 itemsif: {1 itemanyOf: [2 items{1 itemallOf: [2 items{2 itemsfield: "type",
equals: "Microsoft.Compute/virtualMachines"
},
{1 itemanyOf: [10 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
in: [7 items"esri",
"incredibuild",
"MicrosoftDynamicsAX",
"MicrosoftSharepoint",
"MicrosoftVisualStudio",
"MicrosoftWindowsDesktop",
"MicrosoftWindowsServerHPCPack"
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "MicrosoftWindowsServer"
},
{2 itemsfield: "Microsoft.Compute/imageSKU",
notLike: "2008*"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "MicrosoftSQLServer"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
notLike: "SQL2008*"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "microsoft-dsvm"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
like: "dsvm-win*"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "microsoft-ads"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
in: [2 items"standard-data-science-vm",
"windows-data-science-vm"
]
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "batch"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
equals: "rendering-windows2016"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "center-for-internet-security-inc"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
like: "cis-windows-server-201*"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "pivotal"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
like: "bosh-windows-server*"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "cloud-infrastructure-services"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
like: "ad*"
}
]
},
{1 itemallOf: [2 items{1 itemanyOf: [2 items{2 itemsfield: "Microsoft.Compute/virtualMachines/osProfile.windowsConfiguration",
exists: "true"
},
{2 itemsfield: "Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType",
like: "Windows*"
}
]
},
{1 itemanyOf: [2 items{2 itemsfield: "Microsoft.Compute/imageSKU",
exists: "false"
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imageSKU",
notLike: "2008*"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
notLike: "SQL2008*"
}
]
}
]
}
]
}
]
}
]
},
{1 itemallOf: [2 items{2 itemsvalue: "[parameters('IncludeArcMachines')]",
equals: "true"
},
{1 itemanyOf: [2 items{1 itemallOf: [2 items{2 itemsfield: "type",
equals: "Microsoft.HybridCompute/machines"
},
{2 itemsfield: "Microsoft.HybridCompute/imageOffer",
like: "windows*"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "type",
equals: "Microsoft.ConnectedVMwarevSphere/virtualMachines"
},
{2 itemsfield: "Microsoft.ConnectedVMwarevSphere/virtualMachines/osProfile.osType",
like: "windows*"
}
]
}
]
}
]
}
]
},
then: {2 itemseffect: "[parameters('effect')]",
details: {3 itemstype: "Microsoft.GuestConfiguration/guestConfigurationAssignments",
name: "AzureBaseline_SystemAuditPoliciesSystem",
existenceCondition: {1 itemallOf: [2 items{2 itemsfield: "Microsoft.GuestConfiguration/guestConfigurationAssignments/complianceStatus",
equals: "Compliant"
},
{2 itemsfield: "Microsoft.GuestConfiguration/guestConfigurationAssignments/parameterHash",
equals: 🔍"[
    base64(
        concat(
           'Audit Other System Events;ExpectedValue',
            '=',
             parameters('AuditOtherSystemEvents')
        )
    )
]"
}
]
}
}
}
}
}
                                 api-version=2021-06-01

                                  EPAC
                                 {7 itemsdisplayName: "Windows machines should meet requirements for 'System Audit Policies - System'",
policyType: "BuiltIn",
mode: "Indexed",
description: "Windows machines should have the specified Group Policy settings in the category 'System Audit Policies - System' for auditing IPsec driver, system integrity, system extension, state change, and other system events. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol.",
metadata: {4 itemscategory: "Guest Configuration",
version: "3.0.0",
requiredProviders: [1 item"Microsoft.GuestConfiguration"
],
guestConfiguration: {3 itemsname: "AzureBaseline_SystemAuditPoliciesSystem",
version: "1.*",
configurationParameter: {1 itemAuditOtherSystemEvents: "Audit Other System Events;ExpectedValue"
}
}
},
parameters: {3 itemsIncludeArcMachines: {4 itemstype: "String",
metadata: {3 itemsdisplayName: "Include Arc connected servers",
description: "By selecting this option, you agree to be charged monthly per Arc connected machine.",
portalReview: "true"
},
allowedValues: [2 items"true",
"false"
],
defaultValue: "false"
},
AuditOtherSystemEvents: {4 itemstype: "String",
metadata: {2 itemsdisplayName: "Audit Other System Events",
description: "Specifies whether audit events are generated for Windows Firewall Service and Windows Firewall driver start and stop events, failure events for these services and Windows Firewall Service policy processing failures."
},
allowedValues: [4 items"No Auditing",
"Success",
"Failure",
"Success and Failure"
],
defaultValue: "No Auditing"
},
effect: {4 itemstype: "String",
metadata: {2 itemsdisplayName: "Effect",
description: "Enable or disable the execution of this policy"
},
allowedValues: [2 items"AuditIfNotExists",
"Disabled"
],
defaultValue: "AuditIfNotExists"
}
},
policyRule: {2 itemsif: {1 itemanyOf: [2 items{1 itemallOf: [2 items{2 itemsfield: "type",
equals: "Microsoft.Compute/virtualMachines"
},
{1 itemanyOf: [10 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
in: [7 items"esri",
"incredibuild",
"MicrosoftDynamicsAX",
"MicrosoftSharepoint",
"MicrosoftVisualStudio",
"MicrosoftWindowsDesktop",
"MicrosoftWindowsServerHPCPack"
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "MicrosoftWindowsServer"
},
{2 itemsfield: "Microsoft.Compute/imageSKU",
notLike: "2008*"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "MicrosoftSQLServer"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
notLike: "SQL2008*"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "microsoft-dsvm"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
like: "dsvm-win*"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "microsoft-ads"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
in: [2 items"standard-data-science-vm",
"windows-data-science-vm"
]
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "batch"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
equals: "rendering-windows2016"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "center-for-internet-security-inc"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
like: "cis-windows-server-201*"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "pivotal"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
like: "bosh-windows-server*"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "cloud-infrastructure-services"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
like: "ad*"
}
]
},
{1 itemallOf: [2 items{1 itemanyOf: [2 items{2 itemsfield: "Microsoft.Compute/virtualMachines/osProfile.windowsConfiguration",
exists: "true"
},
{2 itemsfield: "Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType",
like: "Windows*"
}
]
},
{1 itemanyOf: [2 items{2 itemsfield: "Microsoft.Compute/imageSKU",
exists: "false"
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imageSKU",
notLike: "2008*"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
notLike: "SQL2008*"
}
]
}
]
}
]
}
]
}
]
},
{1 itemallOf: [2 items{2 itemsvalue: "[parameters('IncludeArcMachines')]",
equals: "true"
},
{1 itemanyOf: [2 items{1 itemallOf: [2 items{2 itemsfield: "type",
equals: "Microsoft.HybridCompute/machines"
},
{2 itemsfield: "Microsoft.HybridCompute/imageOffer",
like: "windows*"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "type",
equals: "Microsoft.ConnectedVMwarevSphere/virtualMachines"
},
{2 itemsfield: "Microsoft.ConnectedVMwarevSphere/virtualMachines/osProfile.osType",
like: "windows*"
}
]
}
]
}
]
}
]
},
then: {2 itemseffect: "[parameters('effect')]",
details: {3 itemstype: "Microsoft.GuestConfiguration/guestConfigurationAssignments",
name: "AzureBaseline_SystemAuditPoliciesSystem",
existenceCondition: {1 itemallOf: [2 items{2 itemsfield: "Microsoft.GuestConfiguration/guestConfigurationAssignments/complianceStatus",
equals: "Compliant"
},
{2 itemsfield: "Microsoft.GuestConfiguration/guestConfigurationAssignments/parameterHash",
equals: 🔍"[
    base64(
        concat(
           'Audit Other System Events;ExpectedValue',
            '=',
             parameters('AuditOtherSystemEvents')
        )
    )
]"
}
]
}
}
}
}
}