What is the purpose of auditing in Windows Server 2008, and how do you enable object access auditing?

• A. Auditing records security-related events; enable via Group Policy and configure auditing at the object level to log access events
• B. Auditing is only for audit logs not security
• C. Auditing can be configured only on servers
• D. Auditing is automatic with no policy

Answer: (A)

Auditing is about tracking security-related actions, such as who accessed a resource, what they did, and when it happened. In Windows Server 2008, you turn this on by enabling a policy that controls auditing and then specifying exactly which objects should log access events.

First, enable the auditing policy for object access through Group Policy (Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy, and enable Audit object access for success and/or failure). Then tell Windows what to audit on each object: go to the object's Security settings, open Advanced, use the Auditing tab to add a principal (for example, Everyone or a specific user or group) and choose the access types to log (Read, Write, Delete, etc.) plus whether to log successful attempts, failed attempts, or both. Once configured, access events for those objects will appear in the Security log, providing a record of who did what and when.

This matches why the statement is correct: auditing records security-related events and requires both policy configuration and object-level auditing settings to log actual access events. It’s not limited to servers or to automatic operation, and it isn’t only about audit logs themselves.