Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Recently, I was trying to reduce spam of my security audits by disabling auditing of "Filtering Platform Packet Drop". In a week's time, I get enough of these audits the fill a 200Mb logfile. I tried disabling this with an Advanced Audit Policy. Unknown to me, the system is currently using the legacy audit system, and this advanced audit policy killed all my audits. I propagated this out using group policy since all of our policies are set this way, so it killed my Windows 7 machines too.

I have been able to restore auditing on my Windows 7 machines, and I tried applying the same fix to my 2008 server, but all I see is a bunch of "Audit policy has changed" events. The fix that worked for the 7 machines is method 2.

Find HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA
Right-click SCENoApplyLegacyAuditPolicy, and then click Modify.
Type 0 in the Value data box, and then click OK.

auditpol.exe /get /category:* reports that there is no auditing enabled on my system.

How can I get auditing restored on my machine without having to restore the machine to a very outdated hard drive image?

share|improve this question

1 Answer 1

I wanted to do the exact same thing and enabled Advanced audit policies. With the advanced Audit policy, roles are reversed in that you specify what you want instead of capturing everything. Because this only works with Vista and above, you might want to separate it from XP policies (for clarification, if nothing else).

To do that, you would Set

Computer Configuration > Windows Settings > Security Settings > Other > Enable Policy

Audit: Force audit policy subcategory settings (Windows Vista or later) to override policy category Settings

then configure

Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies

For example, you will want to go to Object Access and choose what you want to be audited

Object Access: 
Audit Application Generated: Success & Failure
Audit File Share: Success & Failure
Audit Details File Share: Not Configured (this means do not audit)
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.