Uploaded August 2025 | Updated September 2026, 2 weeks ago
Monitor Security Incidents Forensics Privileged Access Malware using Audit Registry Intune Policy #msintune #htmdcommunity
How it Works:
An administrator enables the "Object Access Audit Registry" policy in Intune and sets it to "Success," "Failure," or "Success + Failure."
The administrator then uses other tools (like the Registry Editor or Group Policy) to manually add a SACL to a specific registry key.
When a user or process attempts to access that specific registry key, the system checks the SACL.
If the user's account and the type of access (e.g., a "Write" attempt) match the criteria defined in the SACL, and the Intune policy is enabled, an audit event is generated and logged in the Windows Security Event Log.
====
Why an Organization Would Enable This Policy:
Organizations enable this policy for critical security and compliance reasons. The primary goal is to gain visibility into who is accessing, modifying, or attempting to access sensitive parts of the registry.
Security Monitoring: The registry is a core component of the Windows operating system. Many malware and malicious actors attempt to modify registry keys to achieve persistence, escalate privileges, or disable security features. By auditing access to these keys, security teams can detect suspicious activity early.
Incident Response and Forensics: In the event of a security incident, the audit logs are invaluable. They can help investigators determine:
Which user account was involved.
What registry key was accessed.
What type of access was attempted (e.g., was it a successful write attempt or a failed read attempt?).
When the event occurred.
===
What is this policy?
The "Object Access Audit Registry" policy setting in Microsoft Intune is a granular security auditing policy that allows administrators to monitor and log access to specific registry keys.
Policy Functionality: This policy does not, on its own, enable auditing for every registry access. Instead, it acts as a master switch. When enabled, it allows the Windows operating system to generate security audit events for registry objects that have a System Access Control List (SACL) configured.
==
Protecting Security Features: Many antivirus and endpoint detection and response (EDR) solutions store their configurations in the registry. An attacker might try to disable or tamper with these keys to bypass the security software. By applying a SACL to these specific keys and enabling "Object Access Audit Registry," an organization can immediately log any attempt by an unauthorized process to modify them.
Monitoring Privileged Access: Administrators and service accounts often have elevated permissions. An organization might want to monitor every time a privileged user account attempts to read or write to critical system registry keys, such as those related to user authentication or system services. This helps in detecting potential insider threats or compromised credentials.
Detecting Persistence Mechanisms: Malware often uses the Run or RunOnce registry keys (HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, etc.) to ensure it starts every time the computer boots. By applying a SACL to these keys, an organization can log any new entry created in these locations, providing an early warning of a potential infection.
Intellectual Property Protection: If an organization's custom application stores a critical license key or intellectual property in a specific registry location, they can use this policy to audit any unauthorized access, providing an alert if the information is being exfiltrated.
Monitor Security Incidents Forensics Privileged Access Malware using Audit Registry Intune Policy #msintune #htmdcommunity
How it Works:
An administrator enables the "Object Access Audit Registry" policy in Intune and sets it to "Success," "Failure," or "Success + Failure."
The administrator then uses other tools (like the Registry Editor or Group Policy) to manually add a SACL to a specific registry key.
When a user or process attempts to access that specific registry key, the system checks the SACL.
If the user's account and the type of access (e.g., a "Write" attempt) match the criteria defined in the SACL, and the Intune policy is enabled, an audit event is generated and logged in the Windows Security Event Log.
====
Why an Organization Would Enable This Policy:
Organizations enable this policy for critical security and compliance reasons. The primary goal is to gain visibility into who is accessing, modifying, or attempting to access sensitive parts of the registry.
Security Monitoring: The registry is a core component of the Windows operating system. Many malware and malicious actors attempt to modify registry keys to achieve persistence, escalate privileges, or disable security features. By auditing access to these keys, security teams can detect suspicious activity early.
Incident Response and Forensics: In the event of a security incident, the audit logs are invaluable. They can help investigators determine:
Which user account was involved.
What registry key was accessed.
What type of access was attempted (e.g., was it a successful write attempt or a failed read attempt?).
When the event occurred.
===
What is this policy?
The "Object Access Audit Registry" policy setting in Microsoft Intune is a granular security auditing policy that allows administrators to monitor and log access to specific registry keys.
Policy Functionality: This policy does not, on its own, enable auditing for every registry access. Instead, it acts as a master switch. When enabled, it allows the Windows operating system to generate security audit events for registry objects that have a System Access Control List (SACL) configured.
==
Protecting Security Features: Many antivirus and endpoint detection and response (EDR) solutions store their configurations in the registry. An attacker might try to disable or tamper with these keys to bypass the security software. By applying a SACL to these specific keys and enabling "Object Access Audit Registry," an organization can immediately log any attempt by an unauthorized process to modify them.
Monitoring Privileged Access: Administrators and service accounts often have elevated permissions. An organization might want to monitor every time a privileged user account attempts to read or write to critical system registry keys, such as those related to user authentication or system services. This helps in detecting potential insider threats or compromised credentials.
Detecting Persistence Mechanisms: Malware often uses the Run or RunOnce registry keys (HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, etc.) to ensure it starts every time the computer boots. By applying a SACL to these keys, an organization can log any new entry created in these locations, providing an early warning of a potential infection.
Intellectual Property Protection: If an organization's custom application stores a critical license key or intellectual property in a specific registry location, they can use this policy to audit any unauthorized access, providing an alert if the information is being exfiltrated.
