{ "@odata.context": "https://graph.microsoft.com/beta/$metadata#deviceManagement/configurationPolicies/$entity", "createdDateTime": "2026-03-11T15:41:09.4017133Z", "creationSource": null, "description": "Advanced Security Auditing based on Huntress recommendations", "lastModifiedDateTime": "2026-08-06T00:46:51.0000000Z", "name": "Huntress - Device Security - Audit and Event Logging", "platforms": "windows10", "priorityMetaData": null, "roleScopeTagIds": [ "0" ], "settingCount": 45, "technologies": "mdm", "id": "9dcef76d-632a-46f1-863d-783b70129b7c", "templateReference": { "templateId": "", "templateFamily": "none", "templateDisplayName": null, "templateDisplayVersion": null }, "settings": [ { "id": "0", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_eventlogservice_controleventlogbehavior", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_eventlogservice_controleventlogbehavior_0", "children": [] } } }, { "id": "1", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_eventlogservice_specifymaximumfilesizeapplicationlog", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_eventlogservice_specifymaximumfilesizeapplicationlog_1", "children": [ { "@odata.type": "#microsoft.graph.deviceManagementConfigurationSimpleSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_eventlogservice_specifymaximumfilesizeapplicationlog_channel_logmaxsize", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "simpleSettingValue": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationIntegerSettingValue", "settingValueTemplateReference": null, "value": 512000 } } ] } } }, { "id": "2", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_admx_eventlog_channel_log_retention_2", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_admx_eventlog_channel_log_retention_2_0", "children": [] } } }, { "id": "3", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_eventlogservice_specifymaximumfilesizesecuritylog", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_eventlogservice_specifymaximumfilesizesecuritylog_1", "children": [ { "@odata.type": "#microsoft.graph.deviceManagementConfigurationSimpleSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_eventlogservice_specifymaximumfilesizesecuritylog_channel_logmaxsize", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "simpleSettingValue": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationIntegerSettingValue", "settingValueTemplateReference": null, "value": 512000 } } ] } } }, { "id": "4", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_admx_eventlog_channel_log_retention_3", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_admx_eventlog_channel_log_retention_3_0", "children": [] } } }, { "id": "5", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_admx_eventlog_channel_logmaxsize_3", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_admx_eventlog_channel_logmaxsize_3_1", "children": [ { "@odata.type": "#microsoft.graph.deviceManagementConfigurationSimpleSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_admx_eventlog_channel_logmaxsize_3_channel_logmaxsize", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "simpleSettingValue": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationIntegerSettingValue", "settingValueTemplateReference": null, "value": 512000 } } ] } } }, { "id": "6", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_admx_eventlog_channel_log_retention_4", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_admx_eventlog_channel_log_retention_4_0", "children": [] } } }, { "id": "7", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_eventlogservice_specifymaximumfilesizesystemlog", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_eventlogservice_specifymaximumfilesizesystemlog_1", "children": [ { "@odata.type": "#microsoft.graph.deviceManagementConfigurationSimpleSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_eventlogservice_specifymaximumfilesizesystemlog_channel_logmaxsize", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "simpleSettingValue": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationIntegerSettingValue", "settingValueTemplateReference": null, "value": 512000 } } ] } } }, { "id": "8", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_accountlogon_auditcredentialvalidation", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_accountlogon_auditcredentialvalidation_3", "children": [] } } }, { "id": "9", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_accountlogon_auditkerberosauthenticationservice", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_accountlogon_auditkerberosauthenticationservice_3", "children": [] } } }, { "id": "10", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_accountlogon_auditkerberosserviceticketoperations", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_accountlogon_auditkerberosserviceticketoperations_3", "children": [] } } }, { "id": "11", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_accountlogonlogoff_auditaccountlockout", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_accountlogonlogoff_auditaccountlockout_2", "children": [] } } }, { "id": "12", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_accountlogonlogoff_auditgroupmembership", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_accountlogonlogoff_auditgroupmembership_1", "children": [] } } }, { "id": "13", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_accountlogonlogoff_auditlogoff", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_accountlogonlogoff_auditlogoff_1", "children": [] } } }, { "id": "14", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_accountlogonlogoff_auditlogon", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_accountlogonlogoff_auditlogon_3", "children": [] } } }, { "id": "15", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_accountlogonlogoff_auditnetworkpolicyserver", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_accountlogonlogoff_auditnetworkpolicyserver_3", "children": [] } } }, { "id": "16", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_accountmanagement_auditdistributiongroupmanagement", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_accountmanagement_auditdistributiongroupmanagement_3", "children": [] } } }, { "id": "17", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_accountmanagement_auditotheraccountmanagementevents", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_accountmanagement_auditotheraccountmanagementevents_1", "children": [] } } }, { "id": "18", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_policychange_auditauthenticationpolicychange", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_policychange_auditauthenticationpolicychange_1", "children": [] } } }, { "id": "19", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_policychange_auditauthorizationpolicychange", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_policychange_auditauthorizationpolicychange_1", "children": [] } } }, { "id": "20", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_policychange_auditpolicychange", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_policychange_auditpolicychange_1", "children": [] } } }, { "id": "21", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_dsaccess_auditdirectoryservicechanges", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_dsaccess_auditdirectoryservicechanges_1", "children": [] } } }, { "id": "22", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_objectaccess_auditfileshare", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_objectaccess_auditfileshare_3", "children": [] } } }, { "id": "23", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_accountlogonlogoff_auditotherlogonlogoffevents", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_accountlogonlogoff_auditotherlogonlogoffevents_3", "children": [] } } }, { "id": "24", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_accountmanagement_auditsecuritygroupmanagement", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_accountmanagement_auditsecuritygroupmanagement_3", "children": [] } } }, { "id": "25", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_system_auditsecuritysystemextension", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_system_auditsecuritysystemextension_1", "children": [] } } }, { "id": "26", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_accountlogonlogoff_auditspeciallogon", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_accountlogonlogoff_auditspeciallogon_1", "children": [] } } }, { "id": "27", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_accountmanagement_audituseraccountmanagement", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_accountmanagement_audituseraccountmanagement_3", "children": [] } } }, { "id": "28", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_detailedtracking_auditpnpactivity", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_detailedtracking_auditpnpactivity_1", "children": [] } } }, { "id": "29", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_detailedtracking_auditprocesscreation", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_detailedtracking_auditprocesscreation_1", "children": [] } } }, { "id": "30", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_dsaccess_auditdirectoryserviceaccess", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_dsaccess_auditdirectoryserviceaccess_3", "children": [] } } }, { "id": "31", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_objectaccess_auditdetailedfileshare", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_objectaccess_auditdetailedfileshare_3", "children": [] } } }, { "id": "32", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_objectaccess_auditfilteringplatformconnection", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_objectaccess_auditfilteringplatformconnection_2", "children": [] } } }, { "id": "33", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_objectaccess_auditkernelobject", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_objectaccess_auditkernelobject_3", "children": [] } } }, { "id": "34", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_objectaccess_auditotherobjectaccessevents", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_objectaccess_auditotherobjectaccessevents_3", "children": [] } } }, { "id": "35", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_objectaccess_auditremovablestorage", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_objectaccess_auditremovablestorage_3", "children": [] } } }, { "id": "36", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_policychange_auditfilteringplatformpolicychange", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_policychange_auditfilteringplatformpolicychange_1", "children": [] } } }, { "id": "37", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_policychange_auditmpssvcrulelevelpolicychange", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_policychange_auditmpssvcrulelevelpolicychange_3", "children": [] } } }, { "id": "38", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_policychange_auditotherpolicychangeevents", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_policychange_auditotherpolicychangeevents_3", "children": [] } } }, { "id": "39", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_privilegeuse_auditsensitiveprivilegeuse", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_privilegeuse_auditsensitiveprivilegeuse_3", "children": [] } } }, { "id": "40", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_system_auditipsecdriver", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_system_auditipsecdriver_3", "children": [] } } }, { "id": "41", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_system_auditothersystemevents", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_system_auditothersystemevents_3", "children": [] } } }, { "id": "42", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_system_auditsecuritystatechange", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_system_auditsecuritystatechange_1", "children": [] } } }, { "id": "43", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_system_auditsystemintegrity", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_system_auditsystemintegrity_3", "children": [] } } }, { "id": "44", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_audit_accountmanagement_auditcomputeraccountmanagement", "settingInstanceTemplateReference": null, "auditRuleInformation": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "device_vendor_msft_policy_config_audit_accountmanagement_auditcomputeraccountmanagement_3", "children": [] } } } ] }