System Services: User Access Logging ServiceID: oval:org.secpod.oval:def:23045 | Date: (C)2015-01-07 (M)2023-07-31 |
Class: COMPLIANCE | Family: windows |
This service logs unique client access requests in the form of IP addresses and user names of installed products and roles on the local server. This information can be queried via Powershell by administrators needing to quantify client demand of server software for offline Client Access License (CAL) management. If the service is disabled client requests will not be logged and will not be retrievable via Powershell queries. Stopping the service will not effect query of historical data (see supporting documentation for steps to delete historical data). The local system administrator must consult his or her Windows Server license terms to determine the number of CALs that are required for the server software to be appropriately licensed; use of the UAL service and data does not alter this obligation.
Fix:
(1) GPO: Computer Configuration\Windows Settings\Security Settings\System Services!User Access Logging Service
(2) REG: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\UALSVC!Start
Platform: |
Microsoft Windows Server 2012 R2 |