Security templates - auditing registry keys - WRITE DAC = ?

I would like to use the security templates to setup auditing on registry
keys. In particular, I would like to audit "WRITE DAC" failures. However,
in the security templates, there is no "WRITE DAC" option. I see options for
"CHANGE PERMISSIONS" but I'm uncertain if this is the equivalent of "WRITE
DAC".

In fact, some of the audit settings that exist in REGEDIT are different than
the audit settings in the Security Templates. Is there some sort of secret
code ring that will translate these settings?

Any help would be appreciated as I've got several dozen servers to configure
over the next week or so.

Write DAC (Discretionary Access Control) = Change Permissions so I think
your on the right track.

--
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of attached scripts or code is subject to the terms specified in the
Terms of Use posted at http://www.microsoft.com/info/cpyright.htm
"steve24601" <> wrote in message
news:6D97906E-3F29-4D85-B649-...
>I would like to use the security templates to setup auditing on registry
> keys. In particular, I would like to audit "WRITE DAC" failures.
> However,
> in the security templates, there is no "WRITE DAC" option. I see options
> for
> "CHANGE PERMISSIONS" but I'm uncertain if this is the equivalent of "WRITE
> DAC".
>
> In fact, some of the audit settings that exist in REGEDIT are different
> than
> the audit settings in the Security Templates. Is there some sort of
> secret
> code ring that will translate these settings?
>
> Any help would be appreciated as I've got several dozen servers to
> configure
> over the next week or so.

thanks Scott! now about that secret decoder ring...

"Scott Napolitan [Microsoft]" wrote:

> Write DAC (Discretionary Access Control) = Change Permissions so I think
> your on the right track.
>
> --
> This posting is provided "AS IS" with no warranties, and confers no rights.
> Use of attached scripts or code is subject to the terms specified in the
> Terms of Use posted at http://www.microsoft.com/info/cpyright.htm
> "steve24601" <> wrote in message
> news:6D97906E-3F29-4D85-B649-...
> >I would like to use the security templates to setup auditing on registry
> > keys. In particular, I would like to audit "WRITE DAC" failures.
> > However,
> > in the security templates, there is no "WRITE DAC" option. I see options
> > for
> > "CHANGE PERMISSIONS" but I'm uncertain if this is the equivalent of "WRITE
> > DAC".
> >
> > In fact, some of the audit settings that exist in REGEDIT are different
> > than
> > the audit settings in the Security Templates. Is there some sort of
> > secret
> > code ring that will translate these settings?
> >
> > Any help would be appreciated as I've got several dozen servers to
> > configure
> > over the next week or so.
>
>
>

Do you want cherry or grape? ;-)

"steve24601" <> wrote in message
news:B94B5E20-1E86-4BD4-9496-...
> thanks Scott! now about that secret decoder ring...
>
> "Scott Napolitan [Microsoft]" wrote:
>
> > Write DAC (Discretionary Access Control) = Change Permissions so I
think
> > your on the right track.
> >
> > --
> > This posting is provided "AS IS" with no warranties, and confers no
rights.
> > Use of attached scripts or code is subject to the terms specified in the
> > Terms of Use posted at http://www.microsoft.com/info/cpyright.htm
> > "steve24601" <> wrote in message
> > news:6D97906E-3F29-4D85-B649-...
> > >I would like to use the security templates to setup auditing on
registry
> > > keys. In particular, I would like to audit "WRITE DAC" failures.
> > > However,
> > > in the security templates, there is no "WRITE DAC" option. I see
options
> > > for
> > > "CHANGE PERMISSIONS" but I'm uncertain if this is the equivalent of
"WRITE
> > > DAC".
> > >
> > > In fact, some of the audit settings that exist in REGEDIT are
different
> > > than
> > > the audit settings in the Security Templates. Is there some sort of
> > > secret
> > > code ring that will translate these settings?
> > >
> > > Any help would be appreciated as I've got several dozen servers to
> > > configure
> > > over the next week or so.
> >
> >
> >