I have a 2008-level Windows domain running 5 x 2008 (non-R2) DCs (it's on the roadmap to migrate to R2 or possibly 2012 in the next 9-12 months, but this project needs to be working first), and I need to enable Kerberos Authentication Service events in the Security event log for an AD-integrated web filtering system.
Apparently the "Kerberos Authentication Service" audit setting is new to 2008 R2 and not present in the 2008 GPO interface.
This TechNet article seems to indicate that I should be able to enable the setting on my "Default Domain Controller Policy" from a 2008 R2 member server and it would apply to 2008 servers:
If this policy setting is configured, the following events are generated. The events appear on computers running Windows Server 2008 R2, Windows Server 2008, Windows 7, or Windows Vista.
Event ID Event message
4768 A Kerberos authentication ticket (TGT) was requested.
4771 Kerberos pre-authentication failed.
4772 A Kerberos authentication ticket request failed.
However, I've tried this and 4 of my 5 DCs apply the setting fine, but one of them isn't logging the audit events in the security logs.
Is there a better way to do this on a 2008 (non-R2) server? Is there anything obvious that might be enabled (or disabled) on this oddball DC that's causing it not to accept the R2 setting? Any other ideas of things to check?
I don't see anything unusual in the event logs on the offending DC. Any ideas or help are appreciated.Thanks in advance for any assistance you all can offer.
EDIT: Here is a link to a previous question of mine where I asked how to enable this setting on Server 2008. That question went stale, so I'm asking its next logical extension here.