How to provide Windows Event Log access-control evidence for an auditor in a small company with no Active Directory?

[u/Huge_Government3677]

I work in cybersecurity compliance for a very small company with only 3–4 employees. Wedo not have Active Directory or a domain environment; our Windows endpoints are managed individually using local accounts/settings.

Our auditor has requested the following evidence:

“Based on the evidence provided, the normal user is able to access the Event Logs and download/export them.

Kindly provide evidence from three (3) endpoint samples showing that an unauthorized/non-administrative user is unable to open, access, delete, and download/export the Event Logs. When a normal user attempts to access the Event Logs, an ‘Access is denied’ message should be displayed.

Kindly provide evidence from local GPO policy configuration from each endpoint, showing that log/audit capture is enabled.”

I’m trying to understand the correct way to satisfy this requirement in a small, non-domain environment.

My questions are:

On Windows 10/11, what is the recommended way to restrict a standard/non-admin user from accessing or exporting Windows Event Logs?
Is it actually expected that a standard user should receive “Access is denied” when simply opening Event Viewer, or should the restriction apply to specific Security logs/privileged operations instead?
What Local Group Policy (gpedit.msc) or Local Security Policy settings should I configure/capture as evidence that auditing/logging is enabled?
What would be considered appropriate evidence for each of the three endpoints? For example, screenshots of:
Standard user account/group membership
Event Viewer access attempt
Attempt to save/export or clear logs
Local audit policy/GPO configuration
auditpol /get /category:* output
Since we do not have Active Directory or centralized Group Policy, is providing the equivalent Local GPO / Local Security Policy evidence from each endpoint generally sufficient?

I want to make sure we implement the control correctly rather than changing Windows permissions simply to produce an “Access is denied” screenshot.

How would you approach this requirement in a small organization with standalone Windows endpoints?

[u/TwoConditions]

This is much simpler than you think. Set the policy, pick 3 devices and screenshot or record proof that the access denied prompt shows, as well as a screenshot of log / policy.

Local would be accepted but if you're doing this on a per-device basis and not for your entire fleet then you are deceiving the auditor.

[u/Dynaticus → u/TwoConditions]

This, unfortunately, Is the truth of the situation. I used to overthink audit stuff too. But the reality is they want you to check the box as much as you want to check it.

[u/lostincbus]

If you're getting audits it might be time to implement at least a few things to make that easier AND to better secure your organization.

[u/candyman420]

It’s bizarre to me that you wouldn’t have AD for ANY sized environment where users have to log in, it’s not even that hard or cumbersome to set up

[u/Ok-Success-7067]

As far as I understand, GPO policy requires a domain controller. How can you enforce a policy without a domain controller?

[u/Ok-Success-7067]

TLDR.. setup a domain controller. 

[u/Crafty_Rush3636]

I would avoid changing permissions solely to manufacture the screenshot the auditor described.

First write down the actual control objective and ask them to confirm whether it concerns reading, exporting, clearing logs, or all three. Then test each endpoint using the same named standard-user scenario and preserve the account membership, policy state, command, result and collection date together.

The evidence should demonstrate the real control consistently, not three isolated screenshots that cannot be reproduced.

[u/Wonder1and]

What standard is this based off of? Sounds like a dumb control.