Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Windows Server 2008r2 that is hosted by a 3rd party company (fairly common set up where the hosting company provides the hardware/software).

A few days ago, I noticed all of the Security Auditing was disabled when reviewing the Security log files. Here's an example of the logs:

System audit policy was changed.
Audit Policy Change:
  Category:      Logon/Logoff
  Subcategory:   Logon
  Changes:       Failure removed

System audit policy was changed.
  Audit Policy Change:
  Category:      Logon/Logoff
  Subcategory:   Account Lockout
  Changes:       Failure removed

System audit policy was changed.
Audit Policy Change:
  Category:      Logon/Logoff
  Subcategory:   Special Logon
  Changes:       Failure removed

I am the only one who has access to the server other than the hosting company. I asked the hosting company's engineering team if there was some type of group policy change that disabled all auditing or if someone from their team had disabled the auditing. Their reply was:

"No group policy changes were made to any cloud servers. The CloudServers OU has policy inheritance blocked and there are no GPOs linked to that OU."

My Question: How can I find out how the security auditing was disabled? And is it even possible that Windows Server somehow disabled all security auditing due to some setting or?

share|improve this question
    
do a gpresult /Z > test.txt look at the results, you'll see it there. Only two places that this can be done via gpo or local policy. –  tony roth Aug 21 '12 at 13:37
    
@tonyroth - I've not used gpresult before. I just ran the command and only come up with a few items and the dates are only for today. I couldn't find any switches that specified a date range or similar. Is there a switch I could use that will get everything for the past week? –  Metro Smurf Aug 21 '12 at 13:43
1  
sorry I was not clear, the test.txt file should contain all the policies being applied also run this as administrator. –  tony roth Aug 21 '12 at 14:33
    
Have you exported/saved the security event log and re-enabled failure auditing? I find it quite suspicious that only failure auditing was disabled. I can send more suggestions but I would start with this. –  Lucky Luke Aug 24 '12 at 2:54
    
I did export the relevant security event logs. And re-enabled auditing, plus additional auditing. –  Metro Smurf Aug 24 '12 at 4:36
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.