Recently, I was trying to reduce spam of my security audits by disabling auditing of "Filtering Platform Packet Drop". In a week's time, I get enough of these audits the fill a 200Mb logfile. I tried disabling this with an Advanced Audit Policy. Unknown to me, the system is currently using the legacy audit system, and this advanced audit policy killed all my audits. I propagated this out using group policy since all of our policies are set this way, so it killed my Windows 7 machines too.
I have been able to restore auditing on my Windows 7 machines, and I tried applying the same fix to my 2008 server, but all I see is a bunch of "Audit policy has changed" events. The fix that worked for the 7 machines is method 2.
Find HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA
Right-click SCENoApplyLegacyAuditPolicy, and then click Modify.
Type 0 in the Value data box, and then click OK.
auditpol.exe /get /category:*
reports that there is no auditing enabled on my system.
How can I get auditing restored on my machine without having to restore the machine to a very outdated hard drive image?