Audit Changes to a Registry Key with a SACL

The SACL only produces events when the policy allows the category. **auditpol** sets it without opening the policy editor.

auditpol /get /category:'Object Access'
auditpol /set /subcategory:'Registry' /success:enable /failure:enable
auditpol /get /subcategory:'Registry'

**SeSecurityPrivilege** is required to modify a SACL, and it is not part of the normal admin token by default. Check the token before blaming the key.

whoami /priv | Select-String -Pattern 'SeSecurityPrivilege|SeTakeOwnershipPrivilege'
Get-Acl 'HKLM:\SOFTWARE\Vendor\App' | Format-List
Get-Item 'HKLM:\SOFTWARE\Vendor\App' | Select-Object Name,Property

**Set-AuditRule** writes an entry that records **SetValue** and **Delete** for everyone. Everyone is the right scope here: the goal is to catch the unknown writer.

$key = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey('SOFTWARE\Vendor\App', 'ReadWriteSubTree', 'ChangePermissions')
$acl = $key.GetAccessControl([System.Security.AccessControl.AccessControlSections]::Audit)
$rule = New-Object System.Security.AccessControl.RegistryAuditRule('Everyone','SetValue,Delete','ContainerInherit','None','Success')
$acl.AddAuditRule($rule)
$key.SetAccessControl($acl)
(Get-Acl 'HKLM:\SOFTWARE\Vendor\App').Audit | Select-Object IdentityReference,RegistryRights

Wait for the setting to flip, or flip it yourself once as a control. The timestamp of the control event proves the audit path works.

Set-ItemProperty 'HKLM:\SOFTWARE\Vendor\App' -Name Setting -Value 1
Get-WinEvent -LogName Security -MaxEvents 50 | Where-Object Id -eq 4657 | Select-Object TimeCreated,Message -First 3

Event **4657** names the object, the value, the new data and the **Process Name** with the account. That pair is the answer to who changed it.

$e = Get-WinEvent -LogName Security -FilterXPath "*[System[EventID=4657]]" -MaxEvents 10
$e | ForEach-Object { $x=[xml]$_.ToXml(); [pscustomobject]@{ Time=$_.TimeCreated; Process=($x.Event.EventData.Data | Where-Object Name -eq 'ProcessName').'#text'; User=($x.Event.EventData.Data | Where-Object Name -eq 'SubjectUserName').'#text'; Value=($x.Event.EventData.Data | Where-Object Name -eq 'ObjectValueName').'#text' } }

An active SACL fills the Security log quickly. Remove the entry once the culprit is known and keep the policy only if you need ongoing auditing.

$key = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey('SOFTWARE\Vendor\App', 'ReadWriteSubTree', 'ChangePermissions')
$acl = $key.GetAccessControl([System.Security.AccessControl.AccessControlSections]::Audit)
$acl.Audit | ForEach-Object { $acl.RemoveAuditRule($_) }
$key.SetAccessControl($acl)
(Get-Acl 'HKLM:\SOFTWARE\Vendor\App').Audit