Registry Key for LSA Auditing Configuration

The Windows Registry stores essential parameters that control how the Local Security Authority (LSA) handles security events, logging behavior, and policy enforcement. This article identifies the specific registry key responsible for configuring LSA auditing subsystems, explains its primary configuration values, and outlines how these settings dictate Windows security auditing.

The LSA Auditing Registry Key

The configuration parameters for the Local Security Authority auditing subsystem are located in the following Windows Registry path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

This key houses the core operational settings for LSA, including how system-level objects and events are audited across the operating system.

Key Auditing Parameters

Within the HKLM\SYSTEM\CurrentControlSet\Control\Lsa key, several DWORD values directly govern auditing subsystem behaviors:

• AuditBaseObjects: Controls the auditing of access to global system objects (such as mutexes, events, and semaphores). Setting this value to 1 enables auditing for system-wide named objects, while 0 disables it to reduce log volume.
• AuditBaseDirectories: Dictates whether access to named base directories is audited. When enabled (1), access attempts to these containers generate audit events.
• CrashOnAuditFail: Determines system behavior when the Security Event Log becomes full and cannot write new audit records.
  • 0: The system continues operating normally without logging events.
  • 1: The system triggers a Blue Screen of Death (BSOD) (Stop error 0xC0000244) to prevent unaudited actions when configured by policy.
  • 2: The system has crashed and only administrators can log in to clear the log.
• SCENoApplyLegacyAuditPolicy: Prevents basic audit policies from overriding advanced audit policy subcategories when set to 1.

Lower-Level Policy Storage

While runtime configuration parameters reside in SYSTEM\CurrentControlSet\Control\Lsa, the internal, raw security audit policies are held under:

HKEY_LOCAL_MACHINE\SECURITY\Policy

This key is restricted and accessible only by the SYSTEM account. Direct manual modifications to the SECURITY\Policy key are not recommended; administrators should configure auditing parameters via SYSTEM\CurrentControlSet\Control\Lsa or through Group Policy (secpol.msc / gpedit.msc).