Windows Vista has the ability to record more security events, but the settings are not enabled by default. If your computer becomes compromised, keeping more logging information increases the chances that experts will be able to determine how and when the compromise occurred.

Follow these steps to enable additional security event logging:

1. Select Start > Control Panel.
2. In the left panel, click Classic View.
3. In the Control Panel window, double-click Administrative Tools and then Local Security Policy.
4. If the User Account Control window appears, click Continue.
5. In the left pane, click the small arrow next to Local Policies and then select Audit Policy.
6. Double-click Audit account logon events in the right pane.
   
   
7. In the Properties window, select the Local Security Settings tab.
8. Under Audit these attempts select (check) Success and Failure.
   
   
9. Click OK to save the settings.
10. Repeat Steps 6 through 9 for each Audit policy listed in the right pane.

Additional Security Tips

Last Updated: 02/02/07