{"id":27,"date":"2013-03-26T11:11:34","date_gmt":"2013-03-26T16:11:34","guid":{"rendered":"https:\/\/www.softwareab.net\/wordpress\/?p=27"},"modified":"2013-07-08T07:45:45","modified_gmt":"2013-07-08T12:45:45","slug":"audit-all-file-partition-access-failures-without-killing-your-clicker","status":"publish","type":"post","link":"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/","title":{"rendered":"Audit All File Partition Access Failures – without killing your clicker!"},"content":{"rendered":"

Download WindowKiller runtime files here!<\/a><\/p>\n

If you work in a secure environment, you will almost certainly find that you need to harden your operating system images. As one example, the Defense Information Systems Agency (DISA) has a set of Security Template Implementation Guides (STIGs) that provide a thorough set of practices and actions to ensure that deployed systems are compliant to run on Department of Defense (DoD) networks. Read on to see how to satisfy NTFS partition file auditing requirements without destroying your mouse.<\/p>\n

One of these STIG requirements applies to Windows disk partitions – its name is “SV-32247r1_rule” and it specifies:<\/p>\n

\n

Check Content:\u00c2\u00a0<\/strong>If system-level auditing is not enabled, or if the system and data partitions are not installed on NTFS partitions, then mark this as a finding.<\/p>\n

Open Windows Explorer and use the file and folder properties function to verify that the audit settings on each partition\/drive is configured to audit all “failures” for the “Everyone” group.<\/p>\n

If any partition\/drive is not configured to at least the minimum requirement, then this is a finding.<\/p>\n

Fix Text:<\/strong>\u00c2\u00a0Configure auditing on each partition\/drive to audit all “Failures” for the “Everyone” group.<\/p>\n

\n

The fix for this is easy – from Windows Explorer, open properties for each partition (such as C:) and then select “Advanced” from the Security tab. Then select the “Auditing” tab which initially shows as empty:<\/p>\n

\"setup_audit_everyone\"<\/a><\/p>\n

Click the “Add…” button and then add Everyone as shown below:<\/p>\n

\"audit_everyone\"<\/a><\/p>\n

After you click “OK” then Everyone failure auditing will be added to the partition. Except for one small problem…if you start from a properly hardened OS baseline you will be prompted for every file \/ directory that your user can’t set the auditing upon. For example, “C:\\Documents and Settings” as shown below but also you’ll see all of the files used by your corporate antivirus.<\/p>\n

\"access_denied\"<\/a><\/p>\n

The prompt itself is not a problem – you simply click “Continue” and then let the auditing setting continue onwards. (As long as the root partition is set correctly as well as writable parent folders, the failure auditing will be in force just fine.) However, on the Army Golden Master (AGM) baseline Windows images I start from, there can be literally hundreds of these warning dialogs to click through.<\/p>\n

To fix this I wrote the “WindowKiller”. It is a simple concept, as easy as 1-2-3:<\/p>\n

    \n
  1. Allow the user to search for a window (dialog) on the screen by text;<\/li>\n
  2. Indicate the button to click within the identified window (dialog);<\/li>\n
  3. Send that button a click event.<\/li>\n<\/ol>\n

    \"window_killer\"<\/a><\/p>\n

    To install, simply unzip to a folder and run it; the program requires the .NET framework 3.5 or greater, and has been tested on 32-bit and 64-bit systems.\u00c2\u00a0As the program runs it tells you which windows it found and killed using the window handle as shown below:<\/p>\n

    \"window_killer_working\"<\/a><\/p>\n

    You can work in other programs while the WindowKiller is functional (I’m writing this blog while it’s running right now). Once the long-running process is complete, just click on the “Stop Tracking” button and close the application. To uninstall, simply delete the unzipped files.<\/p>\n

    Enjoy – and let it save your click finger!<\/p>\n

    Download WindowKiller runtime files here!<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

    Download WindowKiller runtime files here! If you work in a secure environment, you will almost certainly find that you need to harden your operating system images. As one example, the Defense Information Systems Agency (DISA) has a set of Security …<\/p>\n

    Audit All File Partition Access Failures – without killing your clicker!<\/span> Read More »<\/a><\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[34,33],"yoast_head":"\nAudit All File Partition Access Failures - without killing your clicker! - softwareab<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Audit All File Partition Access Failures - without killing your clicker! - softwareab\" \/>\n<meta property=\"og:description\" content=\"Download WindowKiller runtime files here! If you work in a secure environment, you will almost certainly find that you need to harden your operating system images. As one example, the Defense Information Systems Agency (DISA) has a set of Security … Audit All File Partition Access Failures – without killing your clicker! Read More »\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/\" \/>\n<meta property=\"og:site_name\" content=\"softwareab\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cloudraticsolutions\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/cloudraticsolutions\/\" \/>\n<meta property=\"article:published_time\" content=\"2013-03-26T16:11:34+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2013-07-08T12:45:45+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2013\/03\/setup_audit_everyone-300x223.png\" \/>\n<meta name=\"author\" content=\"Andrew Bruce\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@realcloudratics\" \/>\n<meta name=\"twitter:site\" content=\"@realcloudratics\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Andrew Bruce\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/\"},\"author\":{\"name\":\"Andrew Bruce\",\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/#\/schema\/person\/1337443eaeb75104e0410b508e67f600\"},\"headline\":\"Audit All File Partition Access Failures – without killing your clicker!\",\"datePublished\":\"2013-03-26T16:11:34+00:00\",\"dateModified\":\"2013-07-08T12:45:45+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/\"},\"wordCount\":541,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/#\/schema\/person\/1337443eaeb75104e0410b508e67f600\"},\"image\":{\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2013\/03\/setup_audit_everyone-300x223.png\",\"keywords\":[\"c#\",\"w2k8r2\"],\"articleSection\":[\"Teknocratica\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/\",\"url\":\"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/\",\"name\":\"Audit All File Partition Access Failures - without killing your clicker! - softwareab\",\"isPartOf\":{\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2013\/03\/setup_audit_everyone-300x223.png\",\"datePublished\":\"2013-03-26T16:11:34+00:00\",\"dateModified\":\"2013-07-08T12:45:45+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/#primaryimage\",\"url\":\"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2013\/03\/setup_audit_everyone.png\",\"contentUrl\":\"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2013\/03\/setup_audit_everyone.png\",\"width\":621,\"height\":463},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.softwareab.net\/wordpress\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"c#\",\"item\":\"https:\/\/www.softwareab.net\/wordpress\/tag\/c-2\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Audit All File Partition Access Failures – without killing your clicker!\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/#website\",\"url\":\"https:\/\/www.softwareab.net\/wordpress\/\",\"name\":\"softwareab\",\"description\":\"Technocratica, Technopolitik, Technophobia\",\"publisher\":{\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/#\/schema\/person\/1337443eaeb75104e0410b508e67f600\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.softwareab.net\/wordpress\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/#\/schema\/person\/1337443eaeb75104e0410b508e67f600\",\"name\":\"Andrew Bruce\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2024\/03\/andy-cartoon.jpg\",\"contentUrl\":\"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2024\/03\/andy-cartoon.jpg\",\"width\":400,\"height\":330,\"caption\":\"Andrew Bruce\"},\"logo\":{\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/#\/schema\/person\/image\/\"},\"description\":\"Team-oriented systems mentor with deep knowledge of numerous software methodologies, technologies, languages, and operating systems. Excited about turning emerging technology into working production-ready systems. Focused on moving software teams to a higher level of world-class application development. Specialties:Software analysis and development...Product management through the entire lifecycle...Discrete product integration specialist!\",\"sameAs\":[\"http:\/\/cloudraticsolutions.net\/\",\"https:\/\/www.facebook.com\/cloudraticsolutions\/\",\"https:\/\/twitter.com\/realcloudratics\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Audit All File Partition Access Failures - without killing your clicker! - softwareab","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/","og_locale":"en_US","og_type":"article","og_title":"Audit All File Partition Access Failures - without killing your clicker! - softwareab","og_description":"Download WindowKiller runtime files here! If you work in a secure environment, you will almost certainly find that you need to harden your operating system images. As one example, the Defense Information Systems Agency (DISA) has a set of Security … Audit All File Partition Access Failures – without killing your clicker! Read More »","og_url":"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/","og_site_name":"softwareab","article_publisher":"https:\/\/www.facebook.com\/cloudraticsolutions\/","article_author":"https:\/\/www.facebook.com\/cloudraticsolutions\/","article_published_time":"2013-03-26T16:11:34+00:00","article_modified_time":"2013-07-08T12:45:45+00:00","og_image":[{"url":"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2013\/03\/setup_audit_everyone-300x223.png"}],"author":"Andrew Bruce","twitter_card":"summary_large_image","twitter_creator":"@realcloudratics","twitter_site":"@realcloudratics","twitter_misc":{"Written by":"Andrew Bruce","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/#article","isPartOf":{"@id":"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/"},"author":{"name":"Andrew Bruce","@id":"https:\/\/www.softwareab.net\/wordpress\/#\/schema\/person\/1337443eaeb75104e0410b508e67f600"},"headline":"Audit All File Partition Access Failures – without killing your clicker!","datePublished":"2013-03-26T16:11:34+00:00","dateModified":"2013-07-08T12:45:45+00:00","mainEntityOfPage":{"@id":"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/"},"wordCount":541,"commentCount":0,"publisher":{"@id":"https:\/\/www.softwareab.net\/wordpress\/#\/schema\/person\/1337443eaeb75104e0410b508e67f600"},"image":{"@id":"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/#primaryimage"},"thumbnailUrl":"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2013\/03\/setup_audit_everyone-300x223.png","keywords":["c#","w2k8r2"],"articleSection":["Teknocratica"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/","url":"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/","name":"Audit All File Partition Access Failures - without killing your clicker! - softwareab","isPartOf":{"@id":"https:\/\/www.softwareab.net\/wordpress\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/#primaryimage"},"image":{"@id":"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/#primaryimage"},"thumbnailUrl":"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2013\/03\/setup_audit_everyone-300x223.png","datePublished":"2013-03-26T16:11:34+00:00","dateModified":"2013-07-08T12:45:45+00:00","breadcrumb":{"@id":"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/#primaryimage","url":"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2013\/03\/setup_audit_everyone.png","contentUrl":"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2013\/03\/setup_audit_everyone.png","width":621,"height":463},{"@type":"BreadcrumbList","@id":"https:\/\/www.softwareab.net\/wordpress\/audit-all-file-partition-access-failures-without-killing-your-clicker\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.softwareab.net\/wordpress\/"},{"@type":"ListItem","position":2,"name":"c#","item":"https:\/\/www.softwareab.net\/wordpress\/tag\/c-2\/"},{"@type":"ListItem","position":3,"name":"Audit All File Partition Access Failures – without killing your clicker!"}]},{"@type":"WebSite","@id":"https:\/\/www.softwareab.net\/wordpress\/#website","url":"https:\/\/www.softwareab.net\/wordpress\/","name":"softwareab","description":"Technocratica, Technopolitik, Technophobia","publisher":{"@id":"https:\/\/www.softwareab.net\/wordpress\/#\/schema\/person\/1337443eaeb75104e0410b508e67f600"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.softwareab.net\/wordpress\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/www.softwareab.net\/wordpress\/#\/schema\/person\/1337443eaeb75104e0410b508e67f600","name":"Andrew Bruce","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.softwareab.net\/wordpress\/#\/schema\/person\/image\/","url":"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2024\/03\/andy-cartoon.jpg","contentUrl":"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2024\/03\/andy-cartoon.jpg","width":400,"height":330,"caption":"Andrew Bruce"},"logo":{"@id":"https:\/\/www.softwareab.net\/wordpress\/#\/schema\/person\/image\/"},"description":"Team-oriented systems mentor with deep knowledge of numerous software methodologies, technologies, languages, and operating systems. Excited about turning emerging technology into working production-ready systems. Focused on moving software teams to a higher level of world-class application development. Specialties:Software analysis and development...Product management through the entire lifecycle...Discrete product integration specialist!","sameAs":["http:\/\/cloudraticsolutions.net\/","https:\/\/www.facebook.com\/cloudraticsolutions\/","https:\/\/twitter.com\/realcloudratics"]}]}},"_links":{"self":[{"href":"https:\/\/www.softwareab.net\/wordpress\/wp-json\/wp\/v2\/posts\/27"}],"collection":[{"href":"https:\/\/www.softwareab.net\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.softwareab.net\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.softwareab.net\/wordpress\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.softwareab.net\/wordpress\/wp-json\/wp\/v2\/comments?post=27"}],"version-history":[{"count":5,"href":"https:\/\/www.softwareab.net\/wordpress\/wp-json\/wp\/v2\/posts\/27\/revisions"}],"predecessor-version":[{"id":379,"href":"https:\/\/www.softwareab.net\/wordpress\/wp-json\/wp\/v2\/posts\/27\/revisions\/379"}],"wp:attachment":[{"href":"https:\/\/www.softwareab.net\/wordpress\/wp-json\/wp\/v2\/media?parent=27"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.softwareab.net\/wordpress\/wp-json\/wp\/v2\/categories?post=27"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.softwareab.net\/wordpress\/wp-json\/wp\/v2\/tags?post=27"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}