Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have configured several avanced audit policy settings under:

Computer Configuration => Policies => Windows Settings => Security Settings => 
Advanced Audit policy Configuration => Audit Policies => ...

Also the following setting is set to "Enabled":

Computer Configuration => Policies => Windows Settings => Security Settings =>
Local Policies => Security Options => Audit: Force audit policy subcategory settings
(Windows Vista or later) to override audit policy category settings.

However none of the advanced audit settings is getting applied. Running

auditpol /get /category:* 

shows all options set to "No Auditing". Also there are none of the deprecated audit policies set.

What surprises me, is that neither gpresult nor rsop.msc show up the "Advanced audit policy" category. What am I doing wrong here? I am running out of ideas. Thanks in advance for your input!

[1. Addendum]

  1. Other settings configured in the same group-policy object are getting applied. So the common pitfalls can be ruled out.

  2. The originally GPO contains MSS settings

  3. Creating a new, empty GPO and only setting the advanced audit configuration items, make them appear on the target server (checked with auditpol). So there must be something wrong with the GPO itself.

[2. Addendum]

  1. Comparing both {GUID}\Machine\Microsoft\Windows NT\Audit\Audit.csv files with each other reveals the following difference. Note the double occurence of "audit".

Non working version of audit.csv:

,System,Audit Policy Change,{0CCE922F-69AE-11D9-BED3-505054503030},Success and Failure,,3

Working version of audit.csv:

,System,Audit Audit Policy Change,{0cce922f-69ae-11d9-bed3-505054503030},Success and Failure,,3

Whats going on here? Any compelling reasons to not edit this file manually?

share|improve this question
Just to get the typical pitfall out of the way: Have you linked the GPO to an OU containing the server, and verified that the GPO itself is getting applied to the machine ? – Mathias R. Jessen Aug 4 '14 at 9:18
Yes, I should have added that information. Other settings configured in the same GPO are getting applied. So that pitfall is out of the way. – Matze Aug 4 '14 at 9:26

2 Answers 2

I realize this is an older question, and that you resolved the issue a different way, however, the reason it wasn't working originally was due to "Audit: Force audit policy subcategory settings" being enabled. As explained in this article on Technet:

The lack of Object Access auditing is expected: as soon as you start applying Advanced Audit Configuration Policy, legacy policies will be completely ignored. The only way to get a Win7/R2 computer to start using legacy policy is to set the security policy “Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings” to DISABLED. That disables the use of the newer policy type. Then you must clear the existing advanced policy from the machines (auditpol.pol /clear, having a blank audit.csv file, etc). The system isn't optimal, but the intention was never for you to go back.

share|improve this answer
up vote 1 down vote accepted

I solved it by the following procedure:

  • Set every advanced audit configuration item to "Not configured"
  • Run gpupdate /force on the relevant systems
  • Re-set all advanced audit configuration according to your requirements

I have created the failing GPO from a template which already had set the advanced audit settings. I guess there was an internal mismatch of the GUIDs...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.