Windows 10 Security baseline - Audit settings on local machine

[Robert Crane]

I have applied in the Windows 10 Baseline security policy via Endpoint Manager in the cloud.

The policy has successfully applied to the local Windows 10 Pro machine.

It is my understanding that the setting under the baseline Audit section i.e. "Account Logon Audit Credential Validation (Device) " for example map to the following registry key:

HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Audit

for example, key = AccountLogon_AuditCredentialValidation

per - https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-audit#audit-accountlogon-a...

However, I can't find these settings in the registry at all. What am I missing?

Basically, what I'm trying to achieve is to verify on the local Win 10 Pro machine that the Windows 10 Baseline policy has indeed set all the values from the policy in the local machine. I'm current stuck on verifying that the baseline policies in the Audit sections are being applied successfully to the local workstation.

Any assistance appreciated.

Thanks

[#2 · Accepted solution]

run this from an elevated command prompt

auditpol /get /category:*