← Back to Unified Endpoint Management Server Security Requirements Guide

V-234327

CAT II (Medium)

The UEM server must initiate session auditing upon startup.

Rule ID

SV-234327r1212954_rule

STIG

Unified Endpoint Management Server Security Requirements Guide

Version

V2R5

CCIs

CCI-001464

Discussion

If auditing is enabled late in the startup process, the actions of some start-up processes may not be audited. Some audit systems also maintain state information only available if auditing is enabled before a given process is created. Satisfies:FAU_GEN.1.1/AUDITGEN

Check Content

Verify the UEM server initiate session auditing upon startup.

If the UEM server does not initiate session auditing upon startup, this is a finding.

Fix Text

Configure the UEM server to initiate session auditing upon startup.