`AC-02(04)` Automated Audit Actions

NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version

unchanged AC Moderate baseline High baseline part of AC-2

Title

Automated Audit Actions

Control

Automatically audit account creation, modification, enabling, disabling, and removal actions.

Discussion

Account management audit records are defined in accordance with [AU-02](#au-2) and reviewed, analyzed, and reported in accordance with [AU-06](#au-6).

Related controls

au-2, au-6

STIG rules that implement this control 53

Apple macOS 15 (Sequoia) V1R8

APPL-15-001001 CAT II The macOS system must be configured to audit all administrative action events.

Apple macOS 26 (Tahoe) V1R4

APPL-26-001001 CAT II The macOS system must be configured to audit all administrative action events.

Application Security and Development V6R5

APSC-DV-000340 CAT II The application must automatically audit account creation.
APSC-DV-000350 CAT II The application must automatically audit account modification.
APSC-DV-000360 CAT II The application must automatically audit account disabling actions.
APSC-DV-000370 CAT II The application must automatically audit account removal actions.
APSC-DV-000380 CAT III The application must notify system administrators (SAs) and information system security officers (ISSOs) when accounts are created.
APSC-DV-000390 CAT III The application must notify system administrators (SAs) and information system security officers (ISSOs) when accounts are modified.
APSC-DV-000400 CAT III The application must notify system administrators (SAs) and information system security officers (ISSOs) of account disabling actions.
APSC-DV-000410 CAT III The application must notify system administrators (SAs) and information system security officers (ISSOs) of account removal actions.
APSC-DV-000420 CAT II The application must automatically audit account enabling actions.
APSC-DV-000430 CAT III The application must notify system administrators (SAs) and information system security officers (ISSOs) of account enabling actions.

Canonical Ubuntu 22.04 LTS V2R10

UBTU-22-654130 CAT II Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
UBTU-22-654135 CAT II Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
UBTU-22-654140 CAT II Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.
UBTU-22-654145 CAT II Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
UBTU-22-654150 CAT II Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.

Canonical Ubuntu 24.04 LTS V1R7

UBTU-24-200280 CAT II Ubuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
UBTU-24-200290 CAT II Ubuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
UBTU-24-200300 CAT II Ubuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
UBTU-24-200310 CAT II Ubuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
UBTU-24-200320 CAT II Ubuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.

Cisco IOS XE Router NDM Y26M04

CISC-ND-000090 CAT II The Cisco router must be configured to automatically audit account creation.
CISC-ND-000100 CAT II The Cisco router must be configured to automatically audit account modification.
CISC-ND-000110 CAT II The Cisco router must be configured to automatically audit account disabling actions.
CISC-ND-000120 CAT II The Cisco router must be configured to automatically audit account removal actions.
CISC-ND-000880 CAT II The Cisco router must be configured to automatically audit account enabling actions.

Microsoft Windows 11 V2R11

WN11-AU-000040 CAT II The system must be configured to audit Account Management - User Account Management successes.

Microsoft Windows Server 2022 V2R11

WN22-AU-000100 CAT II Windows Server 2022 must be configured to audit Account Management - Security Group Management successes.
WN22-AU-000110 CAT II Windows Server 2022 must be configured to audit Account Management - User Account Management successes.
WN22-AU-000120 CAT II Windows Server 2022 must be configured to audit Account Management - User Account Management failures.
WN22-AU-000160 CAT II Windows Server 2022 must be configured to audit Logon/Logoff - Account Lockout failures.
WN22-DC-000230 CAT II Windows Server 2022 must be configured to audit Account Management - Computer Account Management successes.

Microsoft Windows Server 2025 V1R4

WN25-AU-000100 CAT II Windows Server 2025 must be configured to audit Account Management - Security Group Management successes.
WN25-AU-000110 CAT II Windows Server 2025 must be configured to audit Account Management - User Account Management successes.
WN25-AU-000120 CAT II Windows Server 2025 must be configured to audit Account Management - User Account Management failures.
WN25-AU-000150 CAT II Windows Server 2025 must be configured to audit Logon/Logoff - Account Lockout successes.
WN25-AU-000160 CAT II Windows Server 2025 must be configured to audit Logon/Logoff - Account Lockout failures.
WN25-DC-000230 CAT II Windows Server 2025 must be configured to audit Account Management - Computer Account Management successes.

Red Hat Enterprise Linux 10 V1R3

RHEL-10-500680 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers".
RHEL-10-500690 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect the "/etc/sudoers.d/" directory.
RHEL-10-500700 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group".
RHEL-10-500710 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow".
RHEL-10-500720 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd".
RHEL-10-500730 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd".
RHEL-10-500740 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/shadow".

Red Hat Enterprise Linux 9 V2R10

RHEL-09-654215 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
RHEL-09-654220 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/directory.
RHEL-09-654225 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
RHEL-09-654230 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
RHEL-09-654235 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.
RHEL-09-654240 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
RHEL-09-654245 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.

AC-02(04) Automated Audit Actions