ProteOn XPR36, User Manual

Page: 262 / 288

ProteOn XPR36 System | F Security Edition Configuration Guide
244
Auditing Windows Event Logs
Some global auditing information is stored in the Windows Event logs.
However, by default, Windows systems automatically remove this data
without warning.
No ProteOn Manager software information is stored in the Windows Event
Logs. All instrument and application events are saved continuously within the
ProteOn Instrument Log, described on page 4 of this manual.
Determine what data your organization’s policies require to ensure compliance
with 21 CFR Part 11. If any data from the Windows Event logs need to be
saved, the Windows Event log must be reconfigured so that the data is not
removed. Regular manual intervention is required to preserve this data.
The smaller the maximum size of the Event log, the more often the manual
process of viewing, archiving, and clearing the log must occur.
To open and reconfigure the Event Properties log:
1. Go to Administrative Tools and click Event Viewer.
2. Right-click on each log and select Properties.
3. Select Do Not Overwrite Events and substantially increase the
maximum size of the event log to cover any possible messages.
Auditing information generated by the operating system is recorded in the
Windows Security Event Log. Logon failures in ProteOn Manager software,
Security Edition are recorded in this log.
The Security log should be reviewed, archived, and cleared periodically by the
system administrator. During the review process, the log should be examined
for attempted breaches of security, such as a series of failed logon attempts.
To avoid the risk of losing data, the size should be very large, and this
inspection/archive process should occur daily.
Set the Audit Policy as follows:
• Audit account logon events — Failure should be checked at a
minimum.
• Audit account management — Both Success and Failure should
be checked.
• Audit logon events — Failure should be checked at a minimum.
• Audit policy change — Both Success and Failure should be
checked.