auditpolmsg.dll.mui 审核策略 MMC 管理单元消息 3851a301b9f79346cc1bc78799e4aebb

File name:	auditpolmsg.dll.mui
Size:	35328 byte
MD5:	3851a301b9f79346cc1bc78799e4aebb
SHA1:	715fb2a686eabf811b48f09c32f043c121ebe354
SHA256:	12a71f606444d0789ab311aac2adc7d1683157d7f0d97d468e6aa693663941a6
Operating systems:	Windows 10
Extension:	MUI

If an error occurred or the following message in Chinese (Simplified) language and you cannot find a solution, than check answer in English. Table below helps to know how correctly this phrase sounds in English.

id	Chinese (Simplified)	English
1	成功	Success
2	失败	Failure
3	成功和失败	Success and Failure
4	无审核	No Auditing
5	未配置	Not Configured
99	审核策略	Audit Policies
100	系统审核策略	System Audit Policies
101	帐户管理	Account Management
102	审核用户帐户管理	Audit User Account Management
103	审核计算机帐户管理	Audit Computer Account Management
104	审核安全组管理	Audit Security Group Management
105	审核通讯组管理	Audit Distribution Group Management
106	审核应用程序组管理	Audit Application Group Management
107	审核其他帐户管理事件	Audit Other Account Management Events
121	登录/注销	Logon/Logoff
122	审核登录	Audit Logon
123	审核注销	Audit Logoff
124	审核帐户锁定	Audit Account Lockout
125	审核 IPsec 主模式	Audit IPsec Main Mode
126	审核 IPsec 快速模式	Audit IPsec Quick Mode
127	审核 IPsec 扩展模式	Audit IPsec Extended Mode
128	审核特殊登录	Audit Special Logon
129	审核其他登录/注销事件	Audit Other Logon/Logoff Events
130	审核网络策略服务器	Audit Network Policy Server
131	审核用户/设备声明	Audit User / Device Claims
132	审核组成员身份	Audit Group Membership
151	策略更改	Policy Change
152	审核审核策略更改	Audit Audit Policy Change
153	审核身份验证策略更改	Audit Authentication Policy Change
154	审核授权策略更改	Audit Authorization Policy Change
155	审核 MPSSVC 规则级别策略更改	Audit MPSSVC Rule-Level Policy Change
156	审核筛选平台策略更改	Audit Filtering Platform Policy Change
157	审核其他策略更改事件	Audit Other Policy Change Events
181	特权使用	Privilege Use
182	审核敏感权限使用	Audit Sensitive Privilege Use
183	审核非敏感权限使用	Audit Non Sensitive Privilege Use
184	审核其他权限使用事件	Audit Other Privilege Use Events
201	详细跟踪	Detailed Tracking
202	审核进程创建	Audit Process Creation
203	审核进程终止	Audit Process Termination
204	审核 DPAPI 活动	Audit DPAPI Activity
205	审核 RPC 事件	Audit RPC Events
206	审核 PNP 活动	Audit PNP Activity
207	审核令牌权限已调整	Audit Token Right Adjusted
231	系统	System
232	审核安全状态更改	Audit Security State Change
233	审核安全系统扩展	Audit Security System Extension
234	审核系统完整性	Audit System Integrity
235	审核 IPsec 驱动程序	Audit IPsec Driver
236	审核其他系统事件	Audit Other System Events
261	对象访问	Object Access
262	审核文件系统	Audit File System
263	审核注册表	Audit Registry
264	审核内核对象	Audit Kernel Object
265	审核 SAM	Audit SAM
266	审核证书服务	Audit Certification Services
267	审核已生成应用程序	Audit Application Generated
268	审核句柄操作	Audit Handle Manipulation
269	审核文件共享	Audit File Share
270	审核筛选平台数据包丢弃	Audit Filtering Platform Packet Drop
271	审核筛选平台连接	Audit Filtering Platform Connection
272	审核其他对象访问事件	Audit Other Object Access Events
273	审核详细的文件共享	Audit Detailed File Share
274	审核可移动存储	Audit Removable Storage
275	审核中心访问策略暂存	Audit Central Access Policy Staging
291	DS 访问	DS Access
292	审核目录服务访问	Audit Directory Service Access
293	审核目录服务更改	Audit Directory Service Changes
294	审核目录服务复制	Audit Directory Service Replication
295	审核详细的目录服务复制	Audit Detailed Directory Service Replication
321	帐户登录	Account Logon
322	审核凭据验证	Audit Credential Validation
323	审核 Kerberos 服务票证操作	Audit Kerberos Service Ticket Operations
324	审核其他帐户登录事件	Audit Other Account Logon Events
325	审核 Kerberos 身份验证服务	Audit Kerberos Authentication Service
400	高级审核策略配置	Advanced Audit Policy Configuration
500	高级审核配置	Advanced Audit Configuration
501	Microsoft Corporation	Microsoft Corporation
502	为 Windows 配置粒度审核策略。	Configure granular audit policies for Windows.
503	1.0	1.0
602	用户帐户管理 此策略设置允许你审核对用户帐户的更改。包括下列事件: 创建、更改、删除用户帐户；重命名、禁用、启用、锁定或解锁用户帐户。 设置或更改用户帐户的密码。 向用户帐户的 SID 历史记录添加安全标识符(SID)。 配置目录服务还原模式密码。 更改管理用户帐户的权限。 备份或还原凭据管理器凭据。 如果配置此策略设置，则在尝试更改用户帐户时会生成审核事件。成功审核记录成功的尝试，而失败审核记录不成功的尝试。如果不配置此策略设置，则在更改用户帐户时不会生成审核事件。 数量: 低。 默认值: 成功。	User Account Management This policy setting allows you to audit changes to user accounts. Events include the following: A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. A user account’s password is set or changed. A security identifier (SID) is added to the SID History of a user account. The Directory Services Restore Mode password is configured. Permissions on administrative user accounts are changed. Credential Manager credentials are backed up or restored. If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a user account changes. Volume: Low. Default: Success.
603	计算机帐户管理 此策略设置允许你审核由更改计算机帐户(例如在创建、更改或删除计算机帐户时)生成的事件。 如果配置此策略设置，则在尝试更改计算机帐户时会生成审核事件。成功审核记录成功的尝试，而失败审核记录不成功的尝试。 如果不配置此策略设置，则在更改计算机帐户时不会生成审核事件。 数量: 低。 客户端版本上的默认值: 无审核。 服务器版本上的默认值: 成功。	Computer Account Management This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a computer account changes. Volume: Low. Default on Client editions: No Auditing. Default on Server editions: Success.
604	安全组管理 此策略设置允许你审核由更改安全组生成的事件，例如: 创建、更改或删除安全组。 添加或删除安全组成员。 更改组类型。 如果配置此策略设置，则在尝试更改安全组时会生成审核事件。成功审核记录成功的尝试，而失败审核记录不成功的尝试。 如果不配置此策略设置，则在更改安全组时不会生成审核事件。 数量: 低。 默认值: 成功。	Security Group Management This policy setting allows you to audit events generated by changes to security groups such as the following: Security group is created, changed, or deleted. Member is added or removed from a security group. Group type is changed. If you configure this policy setting, an audit event is generated when an attempt to change a security group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a security group changes. Volume: Low. Default: Success.
605	分发组管理 此策略设置允许你审核由更改分发组生成的事件，例如: 创建、更改或删除分发组。 添加或删除分发组成员。 更改分发组类型。 如果配置此策略设置，则在尝试更改分发组时会生成审核事件。成功审核记录成功的尝试，而失败审核记录不成功的尝试。 如果不配置此策略设置，则在更改分发组时不会生成审核事件。 注意: 此子类别中的事件只在域控制器上记录。 数量: 低。 默认值: 无审核。	Distribution Group Management This policy setting allows you to audit events generated by changes to distribution groups such as the following: Distribution group is created, changed, or deleted. Member is added or removed from a distribution group. Distribution group type is changed. If you configure this policy setting, an audit event is generated when an attempt to change a distribution group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a distribution group changes. Note: Events in this subcategory are logged only on domain controllers. Volume: Low. Default: No Auditing.
606	应用程序组管理 此策略设置允许你审核由更改应用程序组生成的事件，例如: 创建、更改或删除应用程序组。 添加或删除应用程序组成员。 如果配置此策略设置，则在尝试更改应用程序组时会生成审核事件。成功审核记录成功的尝试，而失败审核记录不成功的尝试。 如果不配置此策略设置，则在更改应用程序组时不会生成审核事件。 数量: 低。 默认值: 无审核。	Application Group Management This policy setting allows you to audit events generated by changes to application groups such as the following: Application group is created, changed, or deleted. Member is added or removed from an application group. If you configure this policy setting, an audit event is generated when an attempt to change an application group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an application group changes. Volume: Low. Default: No Auditing.
607	其他帐户管理事件 此策略设置允许你审阅由未包含在此类别中的其他用户帐户更改生成的事件，例如: 访问某个用户帐户的密码哈希。这通常发生在 Active Directory 管理工具密码迁移过程中。 调用密码策略检查 API。当恶意应用程序测试此策略以减少在密码字典攻击中的攻击尝试次数时，调用此函数可能导致攻击加重。 更改以下组策略路径下的默认域组策略: 计算机配置\Windows 设置\安全设置\帐户策略\密码策略 计算机配置\Windows 设置\安全设置\帐户策略\帐户锁定策略 注意: 在应用策略设置时记录安全审核事件。在修改设置时不会发生该事件。 数量: 低。 默认值: 无审核。	Other Account Management Events This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. Changes to the Default Domain Group Policy under the following Group Policy paths: Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy Note: The security audit event is logged when the policy setting is applied. It does not occur at the time when the settings are modified. Volume: Low. Default: No Auditing.
622	审核登录 此策略设置允许你审核由计算机上的用户帐户登录尝试所生成的事件。 此子类别中的事件与创建登录会话相关，并且发生在被访问的计算机上。对于交互式登录，会在用户帐户登录的计算机上生成安全审核事件。对于网络登录(例如访问网络上的共享文件夹)，会在承载资源的计算机上生成安全审核事件。包括下列事件: 成功的登录尝试。 失败的登录尝试。 使用明确凭据的登录尝试。当某个进程通过明确指定帐户的凭据来尝试登录该帐户时，将生成此事件。这种情况最常出现在批登录配置中，例如计划任务或使用 RUNAS 命令时。 安全标识符(SID)被筛选掉并且不允许登录。 数量: 在客户端计算机上为低。在域控制器或网络服务器上为中。 客户端版本上的默认值: 成功。 服务器版本上的默认值: 成功、失败。	Audit Logon This policy setting allows you to audit events generated by user account logon attempts on the computer. Events in this subcategory are related to the creation of logon sessions and occur on the computer which was accessed. For an interactive logon, the security audit event is generated on the computer that the user account logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. The following events are included: Successful logon attempts. Failed logon attempts. Logon attempts using explicit credentials. This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch logon configurations, such as scheduled tasks or when using the RUNAS command. Security identifiers (SIDs) were filtered and not allowed to log on. Volume: Low on a client computer. Medium on a domain controller or a network server Default on Client editions: Success. Default on Server editions: Success, Failure.
623	注销 此策略设置允许你审核由关闭登录会话生成的事件。这些事件发生在被访问的计算机上。对于交互式登录，在用户帐户登录的计算机上生成安全审核事件。 如果配置此策略设置，则在关闭登录会话时会生成审核事件。成功审核记录成功的关闭会话尝试，而失败审核记录不成功的关闭会话尝试。 如果不配置此策略设置，则在关闭登录会话时不会生成审核事件。 数量: 低。 默认值: 成功。	Logoff This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. If you do not configure this policy setting, no audit event is generated when a logon session is closed. Volume: Low. Default: Success.
624	帐户锁定 此策略设置允许你审核由尝试登录到已锁定帐户失败而生成的事件。 如果你配置此策略设置，则某个帐户由于帐户已锁定而无法登录到计算机时便会生成审核事件。成功审核会记录成功的尝试，而失败审核会记录不成功的尝试。 登录事件对于了解用户活动以及检测潜在攻击而言是必备的。 数量: 低。 默认值: 成功。	Account Lockout This policy setting allows you to audit events generated by a failed attempt to log on to an account that is locked out. If you configure this policy setting, an audit event is generated when an account cannot log on to a computer because the account is locked out. Success audits record successful attempts and Failure audits record unsuccessful attempts. Logon events are essential for understanding user activity and to detect potential attacks. Volume: Low. Default: Success.
625	IPsec 主模式 此策略设置允许你审核在主模式协商过程中由 Internet 密钥交换协议(IKE)和已验证 Internet 协议(AuthIP)生成的事件。 如果配置此策略设置，则在 IPsec 主模式协商过程中会生成审核事件。成功审核记录成功的尝试，而失败审核记录不成功的尝试。 如果不配置此策略设置，则在 IPsec 主模式协商过程中不会生成审核事件。 数量: 高。 默认值: 无审核。	IPsec Main Mode This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation. Volume: High. Default: No Auditing.
626	IPsec 快速模式 此策略设置允许你审核在快速模式协商过程中由 Internet 密钥交换协议(IKE)和已验证 Internet 协议(AuthIP)生成的事件。 如果配置此策略设置，则在 IPsec 快速模式协商过程中会生成审核事件。成功审核记录成功的尝试，而失败审核记录不成功的尝试。 如果不配置此策略设置，则在 IPsec 快速模式协商过程中不会生成审核事件。 数量: 高。 默认值: 无审核。	IPsec Quick Mode This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.If you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. Volume: High. Default: No Auditing.
627	IPsec 扩展模式 此策略设置允许你审核在扩展模式协商过程中由 Internet 密钥交换协议(IKE)和已验证 Internet 协议(AuthIP)生成的事件。 如果配置此策略设置，则在 IPsec 扩展模式协商过程中会生成审核事件。成功审核记录成功的尝试，而失败审核记录不成功的尝试。 如果不配置此策略设置，则在 IPsec 扩展模式协商过程中不会生成审核事件。 数量: 高。 默认值: 无审核。	IPsec Extended Mode This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation. Volume: High. Default: No Auditing.
628	特殊登录 此策略设置允许你审核由特殊登录生成的事件，例如: 使用特殊登录，特殊登录拥有相当于管理员的权限并且可用于提升进程优先级。 由特殊组成员发起的登录。特殊组允许你审核当某个组的成员登录到你的网络时生成的事件。你可以在注册表中配置一个组安全标识符(SID)列表。如果这些 SID 中的任一个在登录过程中被添加到令牌并且启用了该子类别，则会记录事件。有关此功能的详细信息，请参阅 Microsoft 知识库中的文章 947223 (https://go.microsoft.com/fwlink/?LinkId=121697)。 数量: 低。 默认值: 成功。	Special Logon This policy setting allows you to audit events generated by special logons such as the following : The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see article 947223 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121697). Volume: Low. Default: Success.
629	其他登录/注销事件 此策略设置允许你审核“登录/注销”策略设置未涵盖的其他登录/注销相关事件，例如: 终端服务会话断开连接。 新建终端服务会话。 锁定和解锁工作站。 调用屏幕保护程序。 解除屏幕保护程序。 检测到 Kerberos 重播攻击，即同一条 Kerberos 请求收到两次且信息相同。这可能是由网络配置错误导致的。 授予某个用户或计算机帐户访问无线网络的权限。 授予某个用户或计算机帐户访问有线 802.1x 网络的权限。 数量: 低。 默认值: 无审核。	Other Logon/Logoff Events This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting such as the following: Terminal Services session disconnections. New Terminal Services sessions. Locking and unlocking a workstation. Invoking a screen saver. Dismissal of a screen saver. Detection of a Kerberos replay attack, in which a Kerberos request was received twice with identical information. This condition could be caused by network misconfiguration. Access to a wireless network granted to a user or computer account. Access to a wired 802.1x network granted to a user or computer account. Volume: Low. Default: No Auditing.
630	网络策略服务器 此策略设置允许你审核由 RADIUS (IAS)和网络访问保护(NAP)用户访问请求所生成的审核事件。这些请求可包括授予、拒绝、放弃、隔离、锁定和解锁。 如果配置此策略设置，则会为每个 IAS 和 NAP 用户访问请求生成一个审核事件。成功审核将记录成功的用户访问请求，而失败审核将记录不成功的尝试。 如果不配置此策略设置，则不会审核 IAS 和 NAP 用户访问请求。 数量: 在 NPS 和 IAS 服务器上为中或高。在其他计算机上无。 默认值: 成功、失败。	Network Policy Server This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. If you do not configure this policy settings, IAS and NAP user access requests are not audited. Volume: Medium or High on NPS and IAS server. No volume on other computers. Default: Success, Failure.
631	用户/设备声明 此策略允许你审核用户登录令牌中的用户和设备声明信息。子类别中的事件是在创建登录会话的计算机上生成的。对于交互式登录，将在用户登录到的计算机上生成安全审核事件。对于网络登录(例如，访问网络上的共享文件夹)，将在承载资源的计算机上生成安全审核事件。 如果声明包含在 Active Directory 的用户帐户属性中，则会将用户声明添加到登录令牌中。如果声明包含在 Active Directory 的设备计算机帐户属性中，则会将设备声明添加到登录令牌中。此外，还必须为域以及在用户登录到的计算机上启用复合标识。 如果配置该设置，将为每次成功登录生成一个或多个安全审核事件。你还必须启用“高级审核策略配置”\“系统审核策略”\“登录/注销”下的“审核登录”设置。如果单个安全审核事件中无法容纳用户和设备声明信息，则会生成多个事件。 数量: 客户端计算机上为“低”。域控制器或网络服务器上为“中” 默认值: 无审核。	User / Device Claims This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. User claims are added to a logon token when claims are included with a user's account attributes in Active Directory. Device claims are added to the logon token when claims are included with a device's computer account attributes in Active Directory. In addition, compound identity must be enabled for the domain and on the computer where the user logged on. When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the user and device claims information cannot fit in a single security audit event. Volume: Low on a client computer. Medium on a domain controller or a network server Default: No Auditing.
632	组成员身份 使用此策略可以审核用户登录令牌中的组成员身份信息。创建登录会话时，将在计算机上生成此子类别中的事件。对于交互式登录，将在用户登录到的计算机上生成安全审核事件。对于网络登录(例如，访问网络上的共享文件夹)，将在托管资源的计算机上生成安全审核事件。 如果配置此设置，则将为每次成功登录生成一个或多个安全审核事件。你还必须在“高级审核策略配置”\“系统审核策略”\“登录/注销”下启用“审核登录”设置。如果组成员身份信息无法容纳在单个安全审核事件中，则将生成多个事件。 数量: 客户端计算机上为“低”。域控制器或网络服务器上为“中”。 默认值: 无审核。	Group Membership This policy allows you to audit the group memberhsip information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group memberhsip information cannot fit in a single security audit event. Volume: Low on a client computer. Medium on a domain controller or a network server Default: No Auditing.
652	审核策略更改 此策略设置允许你审核对安全审核策略设置的更改，例如: 设置审核策略对象上的权限和审核设置。 更改系统审核策略。 注册安全事件源。 注销安全事件源。 更改每用户审核设置。 更改 CrashOnAuditFail 的值。 更改文件系统或注册表对象上的系统访问控制列表。 更改特殊组列表。 注意: 当某个对象的系统访问控制列表(SACL)发生更改并且启用策略更改类别时执行 SACL 更改审核。在启用对象访问审核并且将对象的 SACL 配置为审核 DACL/所有者更改时审核自定义访问控制列表(SACL)和所有权更改。 如果配置此策略设置，则在尝试进行远程 RPC 连接时会生成审核事件。成功审核记录成功的尝试，而失败审核记录不成功的尝试。 如果不配置此策略设置，则在尝试进行远程 RPC 连接时不会生成审核事件。 数量: 低。 默认值: 成功。	Audit Policy Change This policy setting allows you to audit changes in the security audit policy settings such as the following: Settings permissions and audit settings on the Audit Policy object. Changes to the system audit policy. Registration of security event sources. De-registration of security event sources. Changes to the per-user audit settings. Changes to the value of CrashOnAuditFail. Changes to the system access control list on a file system or registry object. Changes to the Special Groups list. Note: System access control list (SACL) change auditing is done when a SACL for an object changes and the policy change category is enabled. Discretionary access control list (DACL) and ownership changes are audited when object access auditing is enabled and the object's SACL is configured for auditing of DACL/Owner change. If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted. Volume: Low. Default: Success.
653	身份验证策略更改 此策略设置允许你审核由更改身份验证策略生成的事件，例如: 创建林信任和域信任。 修改林信任和域信任。 删除林信任和域信任。 更改“计算机配置\Windows 设置\安全设置\帐户策略\Kerberos 策略”下的 Kerberos 策略。 为用户或组授予下列任一用户权限: 从网络访问此计算机。 允许本地登录。 允许通过终端服务登录。 作为批处理作业登录。 登录服务。 命名空间冲突。例如，当新信任的名称与某个现有命名空间名称相同时。 如果配置此策略设置，则在尝试更改身份验证策略时会生成审核事件。成功审核记录成功的尝试，而失败审核记录不成功的尝试。 如果不配置此策略设置，则在更改身份验证策略时不会生成审核事件。 注意: 在应用组策略时记录安全审核事件。在修改设置时不会发生该事件。 数量: 低。 默认值: 成功。	Authentication Policy Change This policy setting allows you to audit events generated by changes to the authentication policy such as the following: Creation of forest and domain trusts. Modification of forest and domain trusts. Removal of forest and domain trusts. Changes to Kerberos policy under Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy. Granting of any of the following user rights to a user or group: Access This Computer From the Network. Allow Logon Locally. Allow Logon Through Terminal Services. Logon as a Batch Job. Logon a Service. Namespace collision. For example, when a new trust has the same name as an existing namespace name. If you configure this policy setting, an audit event is generated when an attempt to change the authentication policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when the authentication policy is changed. Note: The security audit event is logged when the group policy is applied. It does not occur at the time when the settings are modified. Volume: Low. Default: Success.
654	授权策略更改 此策略设置允许你审核由更改授权策略生成的事件，例如: 分配不通过“身份验证策略更改”子类别审核的用户权限(特权)，例如 SeCreateTokenPrivilege。 删除不通过“身份验证策略更改”子类别审核的用户权限(特权)，例如 SeCreateTokenPrivilege。 更改加密文件系统(EFS)策略。 更改对象的资源属性。 更改为对象应用的中心访问策略(CAP)。 如果配置此策略设置，则会在尝试更改授权策略时生成审核事件。成功审核将记录成功的尝试，而失败审核记录失败的尝试。 如果不配置此策略设置，则不会在更改授权策略时生成审核事件。 数量: 低。 默认值: 无审核。	Authorization Policy Change This policy setting allows you to audit events generated by changes to the authorization policy such as the following: Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. Changes in the Encrypted File System (EFS) policy. Changes to the Resource attributes of an object. Changes to the Central Access Policy (CAP) applied to an object. If you configure this policy setting, an audit event is generated when an attempt to change the authorization policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when the authorization policy changes. Volume: Low. Default: No Auditing.
655	MPSSVC 规则级别策略更改 此策略设置允许你审核由更改 Microsoft 保护服务(MPSSVC)所使用的策略规则生成的事件。此服务由 Windows 防火墙使用。包括下列事件: 在 Windows 防火墙服务启动时报告活动策略。 更改 Windows 防火墙规则。 更改 Windows 防火墙例外列表。 更改 Windows 防火墙设置。 Windows 防火墙服务忽略或未应用规则。 更改 Windows 防火墙组策略设置。 如果配置此策略设置，则在尝试更改由 MPSSVC 使用的策略规则时会生成审核事件。成功审核记录成功的尝试，而失败审核记录不成功的尝试。 如果不配置此策略设置，则在更改 MPSSVC 所使用的策略规则时不会生成审核事件。 数量: 低。 默认值: 无审核。	MPSSVC Rule-Level Policy Change This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. Events include the following: Reporting of active policies when Windows Firewall service starts. Changes to Windows Firewall rules. Changes to Windows Firewall exception list. Changes to Windows Firewall settings. Rules ignored or not applied by Windows Firewall Service. Changes to Windows Firewall Group Policy settings. If you configure this policy setting, an audit event is generated by attempts to change policy rules used by the MPSSVC. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated by changes in policy rules used by the MPSSVC. Volume: Low. Default: No Auditing.
656	筛选平台策略更改 此策略设置允许你审核由更改 Windows 筛选平台(WFP)生成的事件，例如: IPsec 服务状态。 更改 IPsec 策略设置。 更改 Windows 防火墙策略设置。 更改 WFP 提供程序和引擎。 如果配置此策略设置，则在尝试更改 WFP 时会生成审核事件。成功审核记录成功的尝试，而失败审核记录不成功的尝试。 如果不配置此策略设置，则在更改 WFP 时不会生成审核事件。 数量: 低。 默认值: 无审核。	Filtering Platform Policy Change This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP) such as the following: IPsec services status. Changes to IPsec policy settings. Changes to Windows Firewall policy settings. Changes to WFP providers and engine. If you configure this policy setting, an audit event is generated when a change to the WFP is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a change occurs to the WFP. Volume: Low. Default: No Auditing.
657	其他策略更改事件 此策略设置允许你审核由未在策略更改类别中审核的其他安全策略更改生成的事件，如以下事件: 受信任的平台模块(TPM)配置更改。 内核模式加密自检。 加密提供程序操作。 加密上下文操作或修改。 应用的中心访问策略(CAP)更改。 启动配置数据(BCD)修改。 数量: 低。 默认值: 无审核。	Other Policy Change Events This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: Trusted Platform Module (TPM) configuration changes. Kernel-mode cryptographic self tests. Cryptographic provider operations. Cryptographic context operations or modifications. Applied Central Access Policies (CAPs) changes. Boot Configuration Data (BCD) modifications. Volume: Low. Default: No Auditing.
682	敏感权限使用 此策略设置允许你审核在使用敏感特权(用户权限)时生成的事件，例如: 调用特权服务。 调用下列特权之一: 作为操作系统的一部分。 备份文件和目录。 创建令牌对象。 调试程序。 信任计算机和用户帐户可以执行委派。 生成安全审核。 身份验证后模拟客户端。 加载和卸载设备驱动程序。 管理审核和安全日志。 修改固件环境值。 替换进程级令牌。 还原文件和目录。 取得文件或其他对象的所有权。 如果配置此策略设置，则在发出敏感特权请求时会生成审核事件。成功审核记录成功的请求，而失败审核记录不成功的请求。 如果不配置此策略设置，则在发出敏感特权请求时不会生成审核事件。 数量: 高。	Sensitive Privilege Use This policy setting allows you to audit events generated when sensitive privileges (user rights) are used such as the following: A privileged service is called. One of the following privileges are called: Act as part of the operating system. Back up files and directories. Create a token object. Debug programs. Enable computer and user accounts to be trusted for delegation. Generate security audits. Impersonate a client after authentication. Load and unload device drivers. Manage auditing and security log. Modify firmware environment values. Replace a process-level token. Restore files and directories. Take ownership of files or other objects. If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated when sensitive privilege requests are made. Volume: High.
683	非敏感权限使用 此策略设置允许你审核由使用非敏感特权(用户权限)时生成的事件。 下列权限为非敏感: 作为受信任的呼叫方访问凭据管理器。 从网络访问此计算机。 将工作站添加到域。 为进程调整内存配额。 允许本地登录。 允许通过终端服务登录。 绕过遍历检查。 更改系统时间。 创建页面文件。 创建全局对象。 创建永久共享对象。 创建符号链接。 拒绝从网络访问此计算机。 拒绝作为批处理作业登录。 拒绝作为服务登录。 拒绝本地登录。 拒绝通过终端服务登录。 从远程系统强制关机。 增加进程工作集。 提高计划优先级。 将页面锁定在内存中。 作为批处理作业登录。 作为服务登录。 修改对象标签。 执行卷维护任务。 配置文件单一进程。 配置文件系统性能。 从扩展坞上移除计算机。 关闭系统。 同步目录服务数据。 如果配置此策略设置，则在调用非敏感权限时会生成审核事件。成功审核记录成功的调用，而失败审核记录不成功的调用。 如果不配置此策略设置，则在调用非敏感权限时不会生成审核事件。 数量: 非常高。	Non Sensitive Privilege Use This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). The following privileges are non-sensitive: Access Credential Manager as a trusted caller. Access this computer from the network. Add workstations to domain. Adjust memory quotas for a process. Allow log on locally. Allow log on through Terminal Services. Bypass traverse checking. Change the system time. Create a pagefile. Create global objects. Create permanent shared objects. Create symbolic links. Deny access this computer from the network. Deny log on as a batch job. Deny log on as a service. Deny log on locally. Deny log on through Terminal Services. Force shutdown from a remote system. Increase a process working set. Increase scheduling priority. Lock pages in memory. Log on as a batch job. Log on as a service. Modify an object label. Perform volume maintenance tasks. Profile single process. Profile system performance. Remove computer from docking station. Shut down the system. Synchronize directory service data. If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful calls and Failure audits record unsuccessful calls. If you do not configure this policy setting, no audit event is generated when a non-sensitive privilege is called. Volume: Very High.
684	未使用。	Not used.
702	进程创建 此策略设置允许你审核在创建或启动进程时生成的事件。也会审核创建进程的应用程序或用户的名称。 如果配置此策略设置，则在创建进程时会生成审核事件。成功审核记录成功的尝试，而失败审核记录不成功的尝试。 如果不配置此策略设置，则在创建进程时不会生成审核事件。 数量: 取决于使用计算机的方式。	Process Creation This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a process is created. Volume: Depends on how the computer is used.
703	进程终止 此策略设置允许你审核在进程结束时生成的事件。 如果配置此策略设置，则在进程结束时会生成审核事件。成功审核记录成功的尝试，而失败审核记录不成功的尝试。 如果不配置此策略设置，则在进程结束时不会生成审核事件。 数量: 取决于使用计算机的方式。	Process Termination This policy setting allows you to audit events generated when a process ends. If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a process ends. Volume: Depends on how the computer is used.
704	DPAPI 活动 此策略设置允许你审核在向数据保护应用程序接口(DPAPI)发送加密或解密请求时生成的事件。DPAPI 用于保护机密信息，例如存储的密码和密钥信息。有关 DPAPI 的详细信息，请访问 https://go.microsoft.com/fwlink/?LinkId=121720。 如果配置此策略设置，则在向 DPAPI 发出加密或解密请求时会生成审核事件。成功审核记录成功的请求，而失败审核记录不成功的请求。 如果不配置此策略设置，则在向 DPAPI 发出加密或解密请求时不会生成审核事件。 数量: 低。	DPAPI Activity This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see https://go.microsoft.com/fwlink/?LinkId=121720. If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI. Volume: Low.
705	RPC 事件 此策略设置允许你审核入站远程过程调用(RPC)连接。 如果配置此策略设置，则在尝试进行远程 RPC 连接时会生成审核事件。成功审核记录成功的尝试，而失败审核记录不成功的尝试。 如果不配置此策略设置，则在尝试进行远程 RPC 连接时不会生成审核事件。 数量: 在 RPC 服务器上为高。	RPC Events This policy setting allows you to audit inbound remote procedure call (RPC) connections. If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted. Volume: High on RPC servers.
706	PNP 活动 此策略设置允许你在即插即用检测到外部设备时进行审核。 如果你配置此策略设置，则每当即插即用检测到外部设备时均生成审核事件。仅记录此类别的成功审核。 如果你未配置此策略设置，则当即插即用检测到外部设备时将不生成审核事件。 数量: 低	PNP Activity This policy setting allows you to audit when plug and play detects an external device. If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. Volume: Low
707	令牌权限调整事件 此策略设置允许你通过调整令牌的特权审核生成的事件。 音量: 高。 默认值: 无审核。	Token Right Adjustment Event This policy setting allows you to audit events generated by adjusting the privileges of a token. Volume: High. Default: No Auditing.
732	安全状态更改 此策略设置允许你审核由更改计算机的安全状态生成的事件，例如以下事件: 启动和关闭计算机。 更改系统时间。 从 CrashOnAuditFail 恢复系统，在安全事件日志已满并配置了 CrashOnAuditFail 注册表项的情况下，系统重启后记录该事件。 数量: 低。 默认值: 成功。	Security State Change This policy setting allows you to audit events generated by changes in the security state of the computer such as the following events: Startup and shutdown of the computer. Change of system time. Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured. Volume: Low. Default: Success.
733	安全系统扩展 此策略设置允许你审核与安全系统扩展或服务相关的事件，例如: 安全系统扩展，例如加载验证包、通知包或安全包并在本地安全机构(LSA)注册。这些包用于验证登录尝试、提交登录请求及任何帐户或密码更改。安全系统扩展的示例包括 Kerberos 和 NTLM。 安装服务并在服务控制管理器上注册。审核日志包括有关服务名称、二进制、类型、启动类型和服务帐户的信息。 如果配置此策略设置，则在尝试加载安全系统扩展时会生成审核事件。成功审核记录成功的尝试，而失败审核记录不成功的尝试。 如果不配置此策略设置，则在尝试加载安全系统扩展时不会生成审核事件。 数量: 低。在域控制器上生成安全系统扩展事件的频率比在客户端计算机或成员服务器上高。 默认值: 无审核。	Security System Extension This policy setting allows you to audit events related to security system extensions or services such as the following: A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. If you configure this policy setting, an audit event is generated when an attempt is made to load a security system extension. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an attempt is made to load a security system extension. Volume: Low. Security system extension events are generated more often on a domain controller than on client computers or member servers. Default: No Auditing.
734	系统完整性 此策略设置允许你审核破坏安全子系统完整性的事件，例如: 由于审核系统的问题而无法写入事件日志的事件。 进程在尝试通过在客户端地址空间中执行回复、读取或写入操作模拟客户端时使用无效的本地过程调用(LPC)端口。 检测到危害系统完整性的远程过程调用(RPC)。 检测到可执行文件的哈希值无效(由代码完整性决定)。 危害系统完整性的加密操作。 数量: 低。 默认值: 成功、失败。	System Integrity This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: Events that could not be written to the event log because of a problem with the auditing system. A process that uses a local procedure call (LPC) port that is not valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. The detection of a Remote Procedure Call (RPC) that compromises system integrity. The detection of a hash value of an executable file that is not valid as determined by Code Integrity. Cryptographic operations that compromise system integrity. Volume: Low. Default: Success, Failure.
735	IPsec 驱动程序 此策略设置允许你审核由 IPsec 筛选器驱动程序生成的事件，例如: 启动和关闭 IPsec 服务。 网络数据包由于完整性检查失败而被丢弃。 网络数据包由于重播检查失败而被丢弃。 网络数据包由于是纯文本而被丢弃。 接收的网络数据包带有不正确的安全参数索引(SPI)。这可能表示网卡工作不正常或驱动程序需要更新。 无法处理 IPsec 筛选器。 如果配置此策略设置，则在 IPsec 筛选器驱动程序操作中会生成审核事件。成功审核记录成功的尝试，而失败审核记录不成功的尝试。 如果不配置此策略设置，则在 IPsec 筛选器驱动程序操作中不会生成审核事件。 数量: 低。 默认值: 无审核。	IPsec Driver This policy setting allows you to audit events generated by the IPsec filter driver such as the following: Startup and shutdown of the IPsec services. Network packets dropped due to integrity check failure. Network packets dropped due to replay check failure. Network packets dropped due to being in plaintext. Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card is not working correctly or the driver needs to be updated. Inability to process IPsec filters. If you configure this policy setting, an audit event is generated on an IPsec filter driver operation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated on an IPSec filter driver operation. Volume: Low. Default: No Auditing.
736	其他系统事件 此策略设置允许你审核以下任意事件: 启动和关闭 Windows 防火墙服务和驱动程序。 由 Windows 防火墙服务执行的安全策略处理。 加密密钥文件和迁移操作。 数量: 低。 默认值: 成功、失败。	Other System Events This policy setting allows you to audit any of the following events: Startup and shutdown of the Windows Firewall service and driver. Security policy processing by the Windows Firewall Service. Cryptography key file and migration operations. Volume: Low. Default: Success, Failure.
762	文件系统 此策略设置允许你审核用户访问文件系统对象的尝试。只为指定了系统访问控制列表(SACL)的对象生成安全审核事件，并且只有在请求的访问类型(例如写入、读取或修改)和发出请求的帐户符合 SACL 中的设置时才会生成事件。有关启用对象访问审核的详细信息，请参阅 https://go.microsoft.com/fwlink/?LinkId=122083。 如果配置此策略设置，则在每次帐户访问具有匹配的 SACL 的文件系统对象时都会生成审核事件。成功审核记录成功的尝试，而失败审核记录不成功的尝试。 如果不配置此策略设置，则在帐户访问具有匹配的 SACL 的文件系统对象时不会生成审核事件。 注意: 可以使用文件系统对象的“属性”对话框中的“安全性”选项卡为该对象设置 SACL。 数量: 取决于文件系统 SACL 的配置方式。	File System This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see https://go.microsoft.com/fwlink/?LinkId=122083. If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. Note: You can set a SACL on a file system object using the Security tab in that object's Properties dialog box. Volume: Depends on how the file system SACLs are configured.
763	注册表 此策略设置允许你审核访问注册表对象的尝试。只为指定了系统访问控制列表(SACL)的对象生成安全审核事件，并且只有在请求的访问类型(例如读取、写入或修改)和发出请求的帐户符合 SACL 中的设置时才会生成事件。 如果配置此策略设置，则在每次帐户访问具有匹配的 SACL 的注册表对象时都会生成审核事件。成功审核记录成功的尝试，而失败审核记录不成功的尝试。 如果不配置此策略设置，则在帐户访问具有匹配的 SACL 的注册表对象时不会生成审核事件。 注意: 可以使用“权限”对话框为注册表对象设置 SACL。 数量: 取决于注册表 SACL 的配置方式。	Registry This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL. Note: You can set a SACL on a registry object using the Permissions dialog box. Volume: Depends on how registry SACLs are configured.
764	内核对象 此策略设置允许你审核访问内核的尝试，包括多用户终端执行程序和信号量。 只有具备匹配的系统访问控制列表(SACL)的内核对象会生成安全审核事件。 注意:“审核: 对全局系统对象的访问进行审核”策略设置控制内核对象的默认 SACL。 数量: 如果启用了对全局系统对象的访问进行审核，则为高。	Kernel Object This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. Only kernel objects with a matching system access control list (SACL) generate security audit events. Note: The Audit: Audit the access of global system objects policy setting controls the default SACL of kernel objects. Volume: High if auditing access of global system objects is enabled.
765	SAM 此策略设置允许你审核由尝试访问安全帐户管理器(SAM)对象生成的事件。 SAM 对象包括: SAM_ALIAS -- 本地组。 SAM_GROUP -- 非本地组。 SAM_USER – 用户帐户。 SAM_DOMAIN – 域。 SAM_SERVER – 计算机帐户。 如果配置此策略设置，则在尝试访问内核对象时会生成审核事件。成功审核记录成功的尝试，而失败审核记录不成功的尝试。 如果不配置此策略设置，则在尝试访问内核对象时不会生成审核事件。 注意: 只能修改 SAM_SERVER 的系统访问控制列表(SACL)。 数量: 在域控制器上为高。有关减少在此子类别中生成的事件数量的信息，请参阅 Microsoft 知识库文章 841001 (https://go.microsoft.com/fwlink/?LinkId=121698)。	SAM This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. SAM objects include the following: SAM_ALIAS -- A local group. SAM_GROUP -- A group that is not a local group. SAM_USER – A user account. SAM_DOMAIN – A domain. SAM_SERVER – A computer account. If you configure this policy setting, an audit event is generated when an attempt to access a kernel object is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an attempt to access a kernel object is made. Note: Only the System Access Control List (SACL) for SAM_SERVER can be modified. Volume: High on domain controllers. For information about reducing the amount of events generated in this subcategory, see article 841001 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121698).
766	证书服务 此策略设置允许你审核 Active Directory 证书服务(AD CS)操作。 AD CS 操作包括: AD CS 启动/关闭/备份/还原。 更改证书吊销列表(CRL)。 新的证书申请。 颁发证书。 吊销证书。 更改 AD CS 的证书管理器设置。 更改 AD CS 的配置。 更改证书服务模板。 导入证书。 为 Active Directory 域服务发布证书颁发机构证书。 更改 AD CS 的安全权限。 密钥存档。 导入密钥。 检索密钥。 启动在线证书状态协议(OCSP)响应程序服务。 停止在线证书状态协议(OCSP)响应程序服务。 数量: 在运行 Active Directory 证书服务的计算机上为中或低。	Certification Services This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. AD CS operations include the following: AD CS startup/shutdown/backup/restore. Changes to the certificate revocation list (CRL). New certificate requests. Issuing of a certificate. Revocation of a certificate. Changes to the Certificate Manager settings for AD CS. Changes in the configuration of AD CS. Changes to a Certificate Services template. Importing of a certificate. Publishing of a certification authority certificate is to Active Directory Domain Services. Changes to the security permissions for AD CS. Archival of a key. Importing of a key. Retrieval of a key. Starting of Online Certificate Status Protocol (OCSP) Responder Service. Stopping of Online Certificate Status Protocol (OCSP) Responder Service. Volume: Medium or Low on computers running Active Directory Certificate Services.
767	已生成应用程序 此策略设置允许你审核使用 Windows 审核应用程序编程接口(API)生成事件的应用程序。在设计上使用 Windows 审核 API 的应用程序使用此子类别来记录与其功能相关的审核事件。 属于此子类别的事件包括: 创建应用程序客户端上下文。 删除应用程序客户端上下文。 初始化应用程序客户端上下文。 使用 Windows 审核 API 的其他应用程序操作。 数量: 取决于生成事件的应用程序。	Application Generated This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. Events in this subcategory include: Creation of an application client context. Deletion of an application client context. Initialization of an application client context. Other application operations using the Windows Auditing APIs. Volume: Depends on the applications that are generating them.
768	句柄操作 此策略设置允许你审核在打开或关闭某个对象的句柄时生成的事件。只有具备匹配的系统访问控制列表(SACL)的对象会生成安全审核事件。 如果配置此策略设置，则在处理句柄时会生成审核事件。成功审核记录成功的尝试，而失败审核记录不成功的尝试。 如果不配置此策略设置，则在处理句柄时不会生成审核事件。 注意: 此子类别中的事件只为启用了相应对象访问子类别的对象类型生成事件。例如，如果启用文件系统对象访问，则会生成句柄处理安全审核事件。如果未启用注册表对象访问，则不会生成句柄处理安全审核事件。 数量: 取决于 SACL 的配置方式。	Handle Manipulation This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a handle is manipulated. Note: Events in this subcategory generate events only for object types where the corresponding Object Access subcategory is enabled. For example, if File system object access is enabled, handle manipulation security audit events are generated. If Registry object access is not enabled, handle manipulation security audit events will not be generated. Volume: Depends on how SACLs are configured.
769	文件共享 此策略设置允许你审核访问共享文件夹的尝试。 如果配置此策略设置，则在尝试访问共享文件夹时会生成审核事件。如果定义了此策略设置，则管理员可以指定是仅审核成功、仅审核失败还是同时审核成功和失败。 注意: 共享文件夹不存在系统访问控制列表(SACL)。如果启用此策略设置，则会审核对系统上所有共享文件夹的访问。 数量: 在文件服务器或域控制器上为高，因为组策略要求 SYSVOL 网络访问。	File Share This policy setting allows you to audit attempts to access a shared folder. If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures. Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared folders on the system is audited. Volume: High on a file server or domain controller because of SYSVOL network access required by Group Policy.
770	Windows 筛选平台数据包丢弃 此策略设置允许你审核 Windows 筛选平台(WFP)丢弃的数据包。 数量: 高。	Windows Filtering Platform Packet Drop This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). Volume: High.
771	Windows 筛选平台连接 此策略设置允许你审核 Windows 筛选平台(WFP)允许或阻止的连接。包括下列事件: Windows 防火墙服务阻止应用程序接受网络上的传入连接。 WFP 允许连接。 WFP 阻止连接。 WFP 许可绑定到本地端口。 WFP 阻止绑定到本地端口。 WFP 允许连接。 WFP 阻止连接。 WFP 允许应用程序或服务在端口上侦听传入连接。 WFP 阻止应用程序或服务在端口上侦听传入连接。 如果配置此策略设置，则在 WFP 允许或阻止连接时会生成审核事件。成功审核记录在允许连接时生成的事件，而失败审核记录阻止连接时生成的事件。 如果不配置此策略设置，则在 WFP 允许或阻止连接时不会生成审核事件。 数量: 高。	Windows Filtering Platform Connection This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). The following events are included: The Windows Firewall Service blocks an application from accepting incoming connections on the network. The WFP allows a connection. The WFP blocks a connection. The WFP permits a bind to a local port. The WFP blocks a bind to a local port. The WFP allows a connection. The WFP blocks a connection. The WFP permits an application or service to listen on a port for incoming connections. The WFP blocks an application or service to listen on a port for incoming connections. If you configure this policy setting, an audit event is generated when connections are allowed or blocked by the WFP. Success audits record events generated when connections are allowed and Failure audits record events generated when connections are blocked. If you do not configure this policy setting, no audit event is generated when connected are allowed or blocked by the WFP. Volume: High.
772	其他对象访问事件 此策略设置允许你审核由管理任务计划程序作业或 COM+ 对象生成的事件。 对于计划程序作业，审核以下事件: 创建作业。 删除作业。 启用作业。 禁用作业。 更新作业。 对于 COM+ 对象，审核以下事件: 添加目录对象。 更新目录对象。 删除目录对象。 数量: 低。	Other Object Access Events This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. For scheduler jobs, the following are audited: Job created. Job deleted. Job enabled. Job disabled. Job updated. For COM+ objects, the following are audited: Catalog object added. Catalog object updated. Catalog object deleted. Volume: Low.
773	详细的文件共享 此策略设置允许你审核访问共享文件夹上文件和文件夹的尝试。详细的文件共享设置在每次访问文件或文件夹时记录一个事件，而文件共享设置对于客户端与文件共享之间建立的任何连接只记录一个事件。详细的文件共享审核事件包括有关用于授予或拒绝访问的权限或其他标准的详细信息。 如果配置此策略设置，则在尝试访问共享上的文件或文件夹时会生成审核事件。管理员可以指定是仅审核成功、仅审核失败还是同时审核成功和失败。 注意: 共享文件夹不存在系统访问控制列表(SACL)。如果启用此策略设置，则会审核对系统上所有共享文件和文件夹的访问。 数量: 在文件服务器或域控制器上为高，因为组策略要求 SYSVOL 网络访问。	Detailed File Share This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared files and folders on the system is audited. Volume: High on a file server or domain controller because of SYSVOL network access required by Group Policy.
774	可移动存储 使用此策略设置，你可以审核用户尝试访问可移动存储设备中的文件系统对象的次数。系统仅为所有已申请的访问类型的所有对象生成安全审核事件。 如果配置此策略设置，则帐户每次访问可移动存储上的文件系统对象时均会生成审核事件。成功的审核将记录成功的尝试次数，而失败的审核将记录失败的尝试次数。 如果不配置此策略设置，则帐户访问可移动存储中的文件系统对象时不会生成任何审核事件。	Removable storage This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an account accesses a file system object on a removable storage.
775	中心访问策略暂存 使用此策略设置，你可以在建议的策略所授予或拒绝的权限与对象上当前的中心访问策略不同时，审核访问请求。 如果配置此策略设置，则当用户每次访问对象，且该对象上当前的中心访问策略所授予的权限与建议策略所授予的权限不同时，系统将生成审核事件。将生成如下结果审核事件: 1) 成功审核(如果已配置)，记录当前中心访问策略授予访问权限，而建议的策略拒绝授予的情况下的访问尝试次数。 2) 失败审核(如果已配置)，记录以下情况下的访问尝试次数: a) 当前中心访问策略不授予访问权限，而建议的策略授予访问权限。 b) 主体请求允许的最大访问权限，并且当前中心访问策略授予的访问权限不同于建议的策略授予的访问权限。 卷: 当建议的策略与当前中心访问策略明显不同时，在文件服务器上潜在最常用的资源。 默认: 不审核	Central Access Policy Staging This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. If you configure this policy setting, an audit event is generated each time a user accesses an object and the permission granted by the current central access policy on the object differs from that granted by the proposed policy. The resulting audit event will be generated as follows: 1) Success audits, when configured, records access attempts when the current central access policy grants access but the proposed policy denies access. 2) Failure audits when configured records access attempts when: a) The current central access policy does not grant access but the proposed policy grants access. b) A principal requests the maximum access rights they are allowed and the access rights granted by the current central access policy are different than the access rights granted by the proposed policy. Volume: Potentially high on a file server when the proposed policy differs significantly from the current central access policy. Default: No Auditing
792	目录服务访问 此策略设置允许你审核在访问 Active Directory 域服务(AD DS)对象时生成的事件。 只记录具备匹配的系统访问控制列表(SACL)的 AD DS 对象。 此子类别中的事件与以前版本的 Windows 中提供的目录服务访问事件类似。 数量: 在域控制器上为高。在客户端计算机上无。 客户端版本上的默认值: 无审核。 服务器版本上的默认值: 成功。	Directory Service Access This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. Only AD DS objects with a matching system access control list (SACL) are logged. Events in this subcategory are similar to the Directory Service Access events available in previous versions of Windows. Volume: High on domain controllers. None on client computers. Default on Client editions: No Auditing. Default on Server editions: Success.
793	Active Directory 域服务对象更改 此策略设置允许你审核由更改 Active Directory 域服务(AD DS)中的对象生成的事件。在创建、删除、修改、移动或撤消删除对象时会记录事件。 如果可能，在此子类别中记录的事件会指示对象属性的旧值和新值。 此子类别中的事件只在域控制器上记录，并且只记录 AD DS 中具备匹配的系统访问控制列表(SACL)的对象。 注意: 由于架构中的对象类别上的设置，针对某些对象和属性的操作不会引发审核事件。 如果配置此策略设置，则在尝试更改 AD DS 中的对象时会生成审核事件。成功审核记录成功的尝试，而不会记录不成功的尝试。 如果未配置此策略设置，则在尝试更改 AD DS 中的对象时不会生成审核事件。 数量: 只在域控制器上为高。 默认值: 无审核	Active Directory Domain Services Object Changes This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. When possible, events logged in this subcategory indicate the old and new values of the object’s properties. Events in this subcategory are logged only on domain controllers, and only objects in AD DS with a matching system access control list (SACL) are logged. Note: Actions on some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. If you configure this policy setting, an audit event is generated when an attempt to change an object in AD DS is made. Success audits record successful attempts, however unsuccessful attempts are NOT recorded. If you do not configure this policy setting, no audit event is generated when an attempt to change an object in AD DS object is made. Volume: High on domain controllers only. Default: No Auditing
794	目录服务复制 此策略设置允许你审核两个 Active Directory 域服务(AD DS)域控制器之间的复制操作。 如果配置此策略设置，则在 AD DS 复制过程中会生成审核事件。成功审核记录成功的复制，而失败审核记录不成功的复制。 如果不配置此策略设置，则在 AD DS 复制过程中不会生成审核事件。 注意: 此子类别中的事件只在域控制器上记录。 数量: 在域控制器上为中。在客户端计算机上无。 默认值: 无审核。	Directory Service Replication This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. If you do not configure this policy setting, no audit event is generated during AD DS replication. Note: Events in this subcategory are logged only on domain controllers. Volume: Medium on domain controllers. None on client computers. Default: No Auditing.
795	详细的目录服务复制 此策略设置允许你审核由域控制器之间的详细 Active Directory 域服务(AD DS)复制生成的事件。 数量: 高。 默认值: 无审核。	Detailed Directory Service Replication This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. Volume: High. Default: No Auditing.
822	凭据验证 此策略设置允许你审核通过对用户帐户登录凭据执行验证测试生成的事件。 此子类别中的事件仅发生在作为这些凭据权威的计算机上。对于域帐户，域控制器是权威。对于本地帐户，本地计算机是权威。 数量: 在域控制器上为高。 客户端版本上的默认值: 无审核。 服务器版本上的默认值: 成功。	Credential Validation This policy setting allows you to audit events generated by validation tests on user account logon credentials. Events in this subcategory occur only on the computer that is authoritative for those credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. Volume: High on domain controllers. Default on Client editions: No Auditing. Default on Server editions: Success.
823	Kerberos 服务票证操作 此策略设置允许你审核由为用户帐户提交的 Kerberos 身份验证票证授予票证(TGT)请求生成的事件。 如果配置此策略设置，则在请求某个用户帐户的 Kerberos 身份验证 TGT 时会生成审核事件。成功审核记录成功的请求，而失败审核记录不成功的请求。 如果不配置此策略设置，则在请求某个用户帐户的 Kerberos 身份验证 TGT 时不会生成审核事件。 数量: 低。 客户端版本上的默认值: 无审核。 服务器版本上的默认值: 成功。	Kerberos Service Ticket Operations This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account. Volume: Low. Default on Client editions: No Auditing. Default on Server editions: Success.
824	其他帐户登录事件 此策略设置允许你审核通过响应为用户帐户登录提交的除凭据验证和 Kerberos 票证之外的凭据请求生成的事件。 目前，在此子类别中未包含事件。 默认值: 无审核。	Other Account Logon Events This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. Currently, there are no events in this subcategory. Default: No Auditing.
825	Kerberos 身份验证服务 此策略设置允许你审核由 Kerberos 身份验证票证授予票证(TGT)请求生成的事件。 如果配置此策略设置，则在收到 Kerberos 身份验证 TGT 请求后会生成审核事件。成功审核记录成功的请求，而失败审核记录不成功的请求。 如果不配置此策略设置，则在收到 Kerberos 身份验证 TGT 请求后不会生成审核事件。 数量: 在 Kerberos 密钥发行中心服务器上为高。 客户端版本上的默认值: 无审核。 服务器版本上的默认值: 成功。	Kerberos Authentication Service This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT request. Volume: High on Kerberos Key Distribution Center servers. Default on Client editions: No Auditing Default on Server editions: Success.

File Name:	auditpolmsg.dll.mui
Directory:	%WINDIR%\WinSxS\amd64_microsoft-windows-a..in-native.resources_31bf3856ad364e35_10.0.15063.0_zh-cn_8f6ad2431bbff5d6\
File Size:	34 kB
File Permissions:	rw-rw-rw-
File Type:	Win32 DLL
File Type Extension:	dll
MIME Type:	application/octet-stream
Machine Type:	Intel 386 or later, and compatibles
Time Stamp:	0000:00:00 00:00:00
PE Type:	PE32
Linker Version:	14.10
Code Size:	0
Initialized Data Size:	34816
Uninitialized Data Size:	0
Entry Point:	0x0000
OS Version:	10.0
Image Version:	10.0
Subsystem Version:	6.0
Subsystem:	Windows GUI
File Version Number:	10.0.15063.0
Product Version Number:	10.0.15063.0
File Flags Mask:	0x003f
File Flags:	(none)
File OS:	Windows NT 32-bit
Object File Type:	Dynamic link library
File Subtype:	0
Language Code:	Chinese (Simplified)
Character Set:	Unicode
Company Name:	Microsoft Corporation
File Description:	审核策略 MMC 管理单元消息
File Version:	10.0.15063.0 (WinBuild.160101.0800)
Internal Name:	AuditPolSnapInMsg
Legal Copyright:	© Microsoft Corporation. All rights reserved.
Original File Name:	AuditPolMsg.DLL.MUI
Product Name:	Microsoft® Windows® Operating System
Product Version:	10.0.15063.0
Directory:	%WINDIR%\WinSxS\wow64_microsoft-windows-a..in-native.resources_31bf3856ad364e35_10.0.15063.0_zh-cn_99bf7c955020b7d1\

auditpolmsg.dll.mui is Multilingual User Interface resource file that contain Chinese (Simplified) language for file auditpolmsg.dll (审核策略 MMC 管理单元消息).

File Description:	审核策略 MMC 管理单元消息
File Version:	10.0.15063.0 (WinBuild.160101.0800)
Company Name:	Microsoft Corporation
Internal Name:	AuditPolSnapInMsg
Legal Copyright:	© Microsoft Corporation. All rights reserved.
Original Filename:	AuditPolMsg.DLL.MUI
Product Name:	Microsoft® Windows® Operating System
Product Version:	10.0.15063.0
Translation:	0x804, 1200