2

Recently, I was trying to reduce spam of my security audits by disabling auditing of "Filtering Platform Packet Drop". In a week's time, I get enough of these audits the fill a 200Mb logfile. I tried disabling this with an Advanced Audit Policy. Unknown to me, the system is currently using the legacy audit system, and this advanced audit policy killed all my audits. I propagated this out using group policy since all of our policies are set this way, so it killed my Windows 7 machines too.

I have been able to restore auditing on my Windows 7 machines, and I tried applying the same fix to my 2008 server, but all I see is a bunch of "Audit policy has changed" events. The fix that worked for the 7 machines is method 2.

Find HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA
Right-click SCENoApplyLegacyAuditPolicy, and then click Modify.
Type 0 in the Value data box, and then click OK.

auditpol.exe /get /category:* reports that there is no auditing enabled on my system.

How can I get auditing restored on my machine without having to restore the machine to a very outdated hard drive image?

2 Answers 2

1

I am going to repeat the answer to my question as I was not satisfied with the answer given here initially. I believe this answers this question as well.

From http://jmfcomputers.co.uk/blog/?p=202

(NOTE: Important to set the subcategory settings to "Disabled". That tripped me up for a bit.)

In order to roll back you will need to do the following:

◦ Reset all of your local advanced audit settings. If you did this via GPO, reset the settings in this GPO.

◦ On the 2008 machine use “auditpol /clear” to clear any locally set policies.

◦ You must set the local policy “Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings” to DISABLED. When you do this and it is applied you will see the registry key HKLM\SYSTEM\CurrentControlSet\Control\Lsa – SCENoApplyLegacyAuditPolicy = 0 (DWORD)

◦ Then you need to delete the audit.csv files. For domain based policy this will be in SYSVOL

◦ \[Domain]\sysvol[Domain]\Policies{GUID}\Machine\Microsoft\Windows NT\Audit

◦ For local policies delete the Audit.csv from all of these locations. Some may be hidden, but they are there!!

◦ C:\Windows\security\audit

◦ C:\Windows\System32\GroupPolicy\Machine\Microsoft\Windows NT\Audit

Now reboot or “gpupdate /force” and you should be back to the start again.

Incidentally, once you have got the 2008 R2 machine applying the old Audit policies again I would advise setting the policy “Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings” back to the default of not defined. This way when you move forward with the Advanced Audit settings in the future via GPO you will not have cases where 2008 R2 servers that have this setting disabled that were ”fixed” then will not apply the new advanced audit settings. In order to do this just delete the SCENoApplyLegacyAuditPolicy DWORD value. You will see in the local policy that this has set the policy back to “not defined”.

This appears to have restored auditing to the point it was at prior to enabling advanced auditing on our network.

0

I wanted to do the exact same thing and enabled Advanced audit policies. With the advanced Audit policy, roles are reversed in that you specify what you want instead of capturing everything. Because this only works with Vista and above, you might want to separate it from XP policies (for clarification, if nothing else).

To do that, you would Set

Computer Configuration > Windows Settings > Security Settings > Other > Enable Policy

Audit: Force audit policy subcategory settings (Windows Vista or later) to override policy category Settings

then configure

Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies

For example, you will want to go to Object Access and choose what you want to be audited

Object Access: 
Audit Application Generated: Success & Failure
Audit File Share: Success & Failure
Audit Details File Share: Not Configured (this means do not audit)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .