How to Create Intune Audit Credential Validation Policy

Here, this post will help you in the deployment of the Audit Credential Validation Policy. We’ll make use of Intune’s Settings Catalog to install this policy. We are making use of Configuration Profiles of Intune in the creation of this policy.

Audit Credential Validation Policy setting enables the auditing of events generated by validation tests on user account logon credentials. Events within this subcategory specifically take place on the computer that serves as the authoritative source for those credentials. In the case of domain accounts, the authoritative entity is the domain controller, while for local accounts, it is the local computer.

This specific subcategory is responsible for reporting the outcomes of validation tests conducted on credentials during a user account logon request. These events transpire on the computer recognized as the authoritative source for the respective credentials. In the context of domain accounts, the Domain Controller assumes authority, whereas, for local accounts, the local computer is deemed authoritative.

In environments utilizing domains, the majority of Account Logon events manifest in the Security log of the authoritative Domain Controllers governing domain accounts. Nevertheless, it is noteworthy that these events may also occur on other computers within the organization, particularly when local accounts are employed for logging in. Events falling under this subcategory encompass:

Patch My PC
  • 4774: An account was mapped for logon.
  • 4775: An account could not be mapped for logon.
  • 4776: The Domain Controller attempted to validate the credentials for an account.
  • 4777: The Domain Controller failed to validate the credentials for an account.
Create Intune Audit Credential Validation Policy Fig.1
Create Intune Audit Credential Validation Policy Fig.1

Audit Credential Validation Policy

To create an Audit Credential Validation Policy, follow the steps stated below:

  • Sign in to the Intune Admin Center portal https://intune.microsoft.com/.
  • Select Devices > Windows > Configuration profiles > Create a profile.

In Create Profile, I select Windows 10 and later in Platform, I choose the Profile Type as Settings catalog. Click on the Create button.

Create Intune Audit Credential Validation Policy Fig.2
Create Intune Audit Credential Validation Policy Fig.2

On the Basics tab pane, I provide a name for the policy as “Audit Credential Validation Policy.”

  • Optionally, if you want, you can enter a policy description and proceed by selecting “Next“.
Create Intune Audit Credential Validation Policy Fig.3
Create Intune Audit Credential Validation Policy Fig.3

Now, in Configuration Settings, Click Add Settings to browse or search the catalog for the settings I want to configure.

Create Intune Audit Credential Validation Policy Fig.4
Create Intune Audit Credential Validation Policy Fig.4

In the Settings Picker windows. I searched for the keyword Audit. I found the category Auditing and selected this.

  • I see the sub-category Account Logon Audit Credential Validation. After selecting that, click the cross mark at the right-hand corner, as shown below.
Create Intune Audit Credential Validation Policy Fig.5
Create Intune Audit Credential Validation Policy Fig.5

Here in Auditing, the Account Logon Audit Credential Validation setting has multiple options:

  • Off/ None
  • Success
  • Failure
  • Success + Failure

As a recommended state, here I am choosing Success + Failure.

Create Intune Audit Credential Validation Policy Fig.6
Create Intune Audit Credential Validation Policy Fig.6

Using Scope tags, you can assign a tag to filter the profile to specific IT groups. One can add scope tags (if required). More details on Intune Scope Tags Implementation Guide.

  • Click Next to continue.

Now in Assignments, in Included Groups, you need to click on Add Groups and choose Select Groups to include one or more groups. Click Next to continue.

Create Intune Audit Credential Validation Policy Fig.7
Create Intune Audit Credential Validation Policy Fig.7

In the Review + Create tab, I review settings. After clicking on Create, changes are saved, and the profile is assigned.

Create Intune Audit Credential Validation Policy Fig.8
Create Intune Audit Credential Validation Policy Fig.8

After successfully creating the “Audit Credential Validation Policy,” a notification will appear in the top right-hand corner confirming the action. You can also verify the policy’s existence by navigating to the Configuration Profiles list, where it will be prominently displayed.

Your groups will receive your profile settings when the devices check in with the Intune service. The Policy applies to the device.

Intune Report for Audit Credential Validation Policy

From the Intune Portal, you can view the Intune settings catalog profile report, which provides an overview of device configuration policies and deployment status.

To track the assignment of the policy, you need to select the relevant policy from the Configuration Profiles list, which is the Audit Credential Validation Policy. Then, you can review the device and user check-in status to determine whether the policy has been successfully applied.

  • If you require more detailed information, you can click on “View Report” to access additional insights.
Create Intune Audit Credential Validation Policy Fig.9
Create Intune Audit Credential Validation Policy Fig.9

Registry Key Verification – Audit Credential Validation Policy

Now we will verify whether the policy was successfully deployed or not by accessing the registry settings that will hold the group policy configurations on a specific computer. To accomplish this, you can execute “REGEDIT.exe” on the target computer and navigate to the precise registry path mentioned below, where these settings are stored.

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\providers\5B88AEF1-09E8-43BB-B144-7254ACBBDF3E\default\Device\Audit

When you navigate the above path in the Registry Editor, you will find the registry key named AccountLogon_AuditCredentialValidation. Also, when I navigated to the above path, I saw that the Registry Key was created successfully.

Registry NameValue
AccountLogon_AuditCredentialValidation3
Table 2 – Create Intune Audit Credential Validation Policy
Create Intune Audit Credential Validation Policy Fig.10
Create Intune Audit Credential Validation Policy Fig.10

Windows CSP Details AccountLogon_AuditCredentialValidation

We will see Windows CSP Details for this Policy setting AccountLogon_AuditCredentialValidation. In the absence of configured audit settings or if the audit settings are insufficiently stringent across the computers within your organization, the risk exists that security incidents may go undetected or lack sufficient evidence for subsequent network forensic analysis post-incident.

Conversely, excessively strict audit settings may result in crucial entries in the Security log being overshadowed by a plethora of irrelevant entries, potentially impacting computer performance and available data storage significantly. It’s noteworthy that companies operating in specific regulated industries might be legally obligated to log particular events or activities.

CSP URI – ./Device/Vendor/MSFT/Policy/Config/Audit/AccountLogon_AuditCredentialValidation

Create Intune Audit Credential Validation Policy Fig.11
Create Intune Audit Credential Validation Policy Fig.11

We are on WhatsApp. To get the latest step-by-step guides and news updates, Join our Channel. Click hereHTMD WhatsApp.

Author

Abhinav Rana is working as an SCCM and Intune Admin with several years of experience. He loves to help the community by sharing his knowledge. He is a B.Tech graduate in Information Technology.

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.