Auditlogs of use of lsmaint and lsdata?
Our Audit guys are somewhat troubled that there is no auditing of the use of lsmaint and lsdata (as far as I know at least). Of course it could be debated how useful that would be, but if use of these tools would be logged in for example the event log then at least there is a possibility to store these in a secure location. Anything that is planned?
The catch here is that lsdata and lsmaint are command line utilities outside the envision product itself. The simple act of running a command line executable does not generate a windows event log (or any log for that matter).
The best way I can think of handling this is to turn on file/object auditing for both of those executable files and then read in the enVision appliance's own Windows logs. This should generate a Security_592_Security event whenever one of those files is executed.