The UEM server must initiate session auditing upon startup.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-234327	SRG-APP-000092-UEM-000053	SV-234327r960888_rule		Medium

Description

If auditing is enabled late in the startup process, the actions of some start-up processes may not be audited. Some audit systems also maintain state information only available if auditing is enabled before a given process is created. Satisfies:FAU_GEN.1.1(1)

STIG	Date
Unified Endpoint Management Server Security Requirements Guide	2024-12-09

Details

Check Text (C-37512r613991_chk)

Verify the UEM server initiate session auditing upon startup.

If the UEM server does not initiate session auditing upon startup, this is a finding.

Fix Text (F-37477r613992_fix)

Configure the UEM server to initiate session auditing upon startup.