Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have configured several avanced audit policy settings under:

Computer Configuration => Policies => Windows Settings => Security Settings => 
Advanced Audit policy Configuration => Audit Policies => ...

Also the following setting is set to "Enabled":

Computer Configuration => Policies => Windows Settings => Security Settings =>
Local Policies => Security Options => Audit: Force audit policy subcategory settings
(Windows Vista or later) to override audit policy category settings.

However none of the advanced audit settings is getting applied. Running

auditpol /get /category:* 

shows all options set to "No Auditing". Also there are none of the deprecated audit policies set.

What surprises me, is that neither gpresult nor rsop.msc show up the "Advanced audit policy" category. What am I doing wrong here? I am running out of ideas. Thanks in advance for your input!

[1. Addendum]

  1. Other settings configured in the same group-policy object are getting applied. So the common pitfalls can be ruled out.

  2. The originally GPO contains MSS settings

  3. Creating a new, empty GPO and only setting the advanced audit configuration items, make them appear on the target server (checked with auditpol). So there must be something wrong with the GPO itself.

[2. Addendum]

  1. Comparing both {GUID}\Machine\Microsoft\Windows NT\Audit\Audit.csv files with each other reveals the following difference. Note the double occurence of "audit".

Non working version of audit.csv:

,System,Audit Policy Change,{0CCE922F-69AE-11D9-BED3-505054503030},Success and Failure,,3

Working version of audit.csv:

,System,Audit Audit Policy Change,{0cce922f-69ae-11d9-bed3-505054503030},Success and Failure,,3

Whats going on here? Any compelling reasons to not edit this file manually?

share|improve this question
    
Just to get the typical pitfall out of the way: Have you linked the GPO to an OU containing the server, and verified that the GPO itself is getting applied to the machine ? –  Mathias R. Jessen Aug 4 at 9:18
    
Yes, I should have added that information. Other settings configured in the same GPO are getting applied. So that pitfall is out of the way. –  Matze Aug 4 at 9:26

1 Answer 1

up vote 1 down vote accepted

I solved it by the following procedure:

  • Set every advanced audit configuration item to "Not configured"
  • Run gpupdate /force on the relevant systems
  • Re-set all advanced audit configuration according to your requirements

I have created the failing GPO from a template which already had set the advanced audit settings. I guess there was an internal mismatch of the GUIDs...

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.