Configuring the local security settings rule

The Local Security Settings rule allows you to use real time information about security settings, such as password policy, audit policy, user rights, and security options in your rule.

To configure the Local Security Settings rule:

1. Create the new audit using one of the methods in Creating an audit . (If you want to create this rule for a snapshot specification, see Creating a snapshot specification .)
2. Select an Audit Source:  Server, Snapshot, Snapshot Specification, or No Source. (Some audit rules, such as Application Configuration and Windows User’s and Groups, must have a source.)
3. In the Audit window, from the Views pane, select Rules >Local Security Settings.
4. In the content pane of the Audit window, expand the top level node in the Available for Audit section and select an Internet Information Server rule that you want to create a rule from.
5. Click the right arrow button to move the rule object into the Selected for Audit section. All Internet Information Server rules that you configure will be audited on the target servers or snapshot specification.
6. For each rule, select one of the following check types:
   • Property Values: A values-based check that checks individual properties of the target object. For this type of check, each object requires that you build an expression that defines properties related to the object using the drop down lists at the bottom of the rule window. You can specify a unique operator which, depending on the type of object, can be a String, a Number (integer or float), Boolean (comparing values of ‘true’ and ‘false’), Date (a date compare, not a time of day compare), or an Array.
   • Equivalent to source: A comparison check that performs a one to one comparison between the object on the source vs. the target servers. In this type of check, the values of each property selected from both the source and target servers must match exactly for the object to be compliant.
   • Non-existence: Checks for the non-existence of an object, to determine if it does not exist on the target server. If the object exists on the target server, then the rule is out of compliance. For example, you could check a server to make sure it does not contain a specific COM+ object. Note that, at runtime, the source server, if any, is not queried.  Also, if a Wildcard rule object is selected, it will only apply to the target server.
7. You can also configure a rule based on a wildcard search by selecting the Wildcard rule object .
   
   When you select this object a Name field displays in the rule configuration section at the bottom of the window. Enter a name (primary key) that will be searched on the target server.
   
   For example, you could enter simply * which would match everything on the target, P* would match all objects that begin with a capital P, while *P would match all elements ending with uppercase character 'P'.
   
   After you enter a name or wildcard string, you can configure the rule parameters as you did in step 6.
   
   It is important to notice that when using wildcards, all matching objects are restricted by the rule configurations. This type of audit rule is considered compliant if all found objects match the rule parameters.
8. To finish configuring the audit, set the target servers, any rule exceptions, the schedule, and the notification for the audit.
9. To save the audit, from the File menu, select Save. You can also save the Audit as a policy. See Saving an audit or a snapshot specification as an audit policy.
10. To run the audit, from the Actions menu, select Run Audit. See Running an audit .