Microsoft security advisory: Update to improve Windows command-line auditing: February 10, 2015

This update adds a new feature to Windows that expands the Audit Process Creation policy. This new feature, when it is enabled and configured, creates an event log every time that a process is created, and it includes the command-line information that's passed to that process. These events are logged in existing event ID 4688 and in the Windows Security log. Monitoring these events can provide valuable information to help administrators troubleshoot and investigate security-related activities.

After this update is applied and configured, a new element within security event 4688 will appear with the name of Process Command Line, as shown in the following screen shot:

 


To take full advantage of this feature, administrators must follow these steps:

1. Enable the Audit Process Creation policy.
2.  Enable the "Include command line in process creation events" feature. 

For more information about how to configure these two features, see the Configuration section.

Background on the Audit Process Creation policy

The Audit Process Creation policy is a security audit policy that determines whether the operating system generates an audit event when a process is created. By default, this policy is not configured and no audit events are logged when processes are created. When this policy is enabled, event ID 4688 is generated and logged in the Windows Security log. Enabling this policy is required to make the expanded command-line auditing feature that's described in this security advisory work. For more information about the Audit Process Creation Policy, see the following Mimcrosoft TechNet article: 

Configuration

Enabling Audit Process Creation

To enable the Audit Process Creation policy, edit the following Group Policy settings:

Enabling the "Include command line in process creation events" feature

To enable the new feature that's described in this Knowledge Base article, edit the following Group Policy settings:
Note When you configure and use Advanced Audit Policy Configuration settings, you must confirm that the settings are not overwritten by basic audit policy settings. Event 4719 is logged when the settings are overwritten.

The basic audit policy settings can be checked by going to Computer Configuration\Policies\Windows Settings\Security Settings\Audit Policy. You can make sure that the Advanced Audit Policy Configuration settings are not overwritten by enabling the Audit: Force audit policy subcategory settings (Windows Vista or later versions) to override audit policy category settings in the following location:

If you do not already have a formal plan about how to deploy and use a security audit policy in your environment, we strongly recommend that you read the Security auditing documentation on TechNet and also in the Additional resources section.

Additional resources

For more information, go to the following Microsoft websites:

Microsoft Download Center links

The following files are available for download from the Microsoft Download Center.

Security update for Windows 7 (KB3004375)

Download the package now.

Security update for Windows 7 for x64-based Systems (KB3004375)

Download the package now.

Security update for Windows Embedded Standard 7 (KB3004375)

Download the package now.

Security update for Windows Embedded Standard 7 for x64-based Systems (KB3004375)

Download the package now.

Security update for Windows Server 2008 R2 x64 Edition (KB3004375)

Download the package now.

Security update for Windows Server 2008 R2 for Itanium-based Systems (KB3004375)

Download the package now.

Security update for Windows 8 (KB3004375)

Download the package now.

Security update for Windows 8 for x64-based Systems (KB3004375)

Download the package now.

Security update for Windows Server 2012 (KB3004375)

Download the package now.

Release Date: February 10, 2015

For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base:

119591 How to obtain Microsoft support files from online services

Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

Known issues with this security update

• After you apply this update, Microsoft System Center Configuration Manager clients that report to a particular server or subset of servers may repeatedly become inactive. You may also notice that the clients do not send inventory information for 30 days or more and that the data in the Inventoryagent.log file is static. Additionally, the ClientIDManagerStartup.log file displays repeated occurrences of the following error:
  
  
  [RegTask] - Client is not registered. Sending registration request for GUID:4874BD6C-CB98-4EEB-9F4F-721CC65B25C3 ...
  [RegTask] - Client is registered. Server assigned ClientID is GUID:4874BD6C-CB98-4EEB-9F4F-721CC65B25C3. Approval status 1
  SetRegistrationState failed (0x80071770)
  [RegTask] - Sleeping for 15360 seconds ...
  
  To resolve this issue, apply one of the following security updates:
  
  3023562 MS15-010: Description of the security update for Windows kernel mode driver: February 10, 2015
  
  3046049 MS15-031: Vulnerability in SChannel could allow security feature bypass: March 10, 2015
  This will update your version of cng.sys. After you apply either of these updates and then restart the computer, the affected client will successfully send up a heartbeat and update the inventory data. This action will also enable the client to remain active.
  
• After you apply this update, some web server applications may fail with decryption errors that resemble the following:
  
  
  Failed to decrypt using provider 'DataProtectionConfigurationProvider'. Error message from the provider: The specified file could not be decrypted. (Exception from HRESULT: 0x80071771)
  
  
  
  To resolve this issue, install security update 3046049. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
  
  3046049 MS15-031: Vulnerability in SChannel could allow security feature bypass: March 10, 2015
• 
  
  After you apply this update, Microsoft System Center Configuration Manager clients that report to a particular server or subset of servers may repeatedly become inactive. You may also notice that the clients do not send inventory information for 30 days or more and that the data in the Inventoryagent.log file is static. Additionally, the ClientIDManagerStartup.log displays repeated occurrences of the following error:
  
  
  
  
  
  
  
  [RegTask] - Client is not registered. Sending registration request for GUID:4874BD6C-CB98-4EEB-9F4F-721CC65B25C3 ...
  [RegTask] - Client is registered. Server assigned ClientID is GUID:4874BD6C-CB98-4EEB-9F4F-721CC65B25C3. Approval status 1
  SetRegistrationState failed (0x80071770)
  [RegTask] - Sleeping for 15360 seconds ...
  
  
  
  
  
  To resolve this issue, apply either of the following security updates:
  
  3023562 MS15-010: Description of the security update for Windows kernel mode driver: February 10, 2015
  
  
  
  3046049 MS15-031: Vulnerability in SChannel could allow security feature bypass: March 10, 2015
  
  
  
  
  
  This will update your version of cng.sys. After you apply either of these updates and then restart the computer, the affected client will successfully send up a heartbeat and update the inventory data. This action will also enable the client to remain active.