I have a 2008-level Windows domain running 5 x 2008 (non-R2) DCs (it's on the roadmap to migrate to R2 or possibly 2012 in the next 9-12 months, but this project needs to be working first), and I need to enable Kerberos Authentication Service events in the Security event log for an AD-integrated web filtering system.
I already asked this question about figuring out how to make the initial configuration changes, and found out that the reason why I couldn't find the appropriate GPO settings in GPMC on my 2008 DCs is that the setting is new to 2008 R2.
So based on the feedback in that question, I enabled the appropriate settings in the Default Domain Controllers GPO from GPMC on a 2008 R2 member server, and it appears to be working properly (i.e. I'm seeing the Kerberos security log events being generated) on 4 of my 5 DCs, but I can't figure out what's different about the 5th one (it's actually #2 in chronological build order). All are running 2008 non-R2, all patched to the same level, all DCs/GC masters. I did a
gpupdate /force and then rebooted the offending DC with no change in the behavior.
The TechNet article seems to indicate that it should apply to 2008 servers:
If this policy setting is configured, the following events are generated. The events appear on computers running Windows Server 2008 R2, Windows Server 2008, Windows 7, or Windows Vista.
Event ID Event message
4768 A Kerberos authentication ticket (TGT) was requested.
4771 Kerberos pre-authentication failed.
4772 A Kerberos authentication ticket request failed.
So my question is: How can I better troubleshoot this GPO setting not being applied properly? Normally I would do a
gpresult /r or RSoP, but since 2008 isn't even aware of the setting, it doesn't show up there, even on the DCs that are respecting the setting properly. When I do an RSoP from the R2 member server, the setting doesn't show up, presumably because the gathering of RSoP data is actually being done on the DC and sent back to the member server.
I don't see anything aberrant in the event logs on the offending DC. Any ideas or help are appreciated. Thanks!