3

I have a 2008-level Windows domain running 5 x 2008 (non-R2) DCs (it's on the roadmap to migrate to R2 or possibly 2012 in the next 9-12 months, but this project needs to be working first), and I need to enable Kerberos Authentication Service events in the Security event log for an AD-integrated web filtering system.

Apparently the "Kerberos Authentication Service" audit setting is new to 2008 R2 and not present in the 2008 GPO interface.

This TechNet article seems to indicate that I should be able to enable the setting on my "Default Domain Controller Policy" from a 2008 R2 member server and it would apply to 2008 servers:

If this policy setting is configured, the following events are generated. The events appear on computers running Windows Server 2008 R2, Windows Server 2008, Windows 7, or Windows Vista.

Event ID Event message

4768 A Kerberos authentication ticket (TGT) was requested.

4771 Kerberos pre-authentication failed.

4772 A Kerberos authentication ticket request failed.

However, I've tried this and 4 of my 5 DCs apply the setting fine, but one of them isn't logging the audit events in the security logs.

Is there a better way to do this on a 2008 (non-R2) server? Is there anything obvious that might be enabled (or disabled) on this oddball DC that's causing it not to accept the R2 setting? Any other ideas of things to check?

I don't see anything unusual in the event logs on the offending DC. Any ideas or help are appreciated.Thanks in advance for any assistance you all can offer.

EDIT: Here is a link to a previous question of mine where I asked how to enable this setting on Server 2008. That question went stale, so I'm asking its next logical extension here.

Improve this question
1
  • I'm linking your previous question on this, as it may help clarify for the experts what you have already dealt with, you should include it as a link in your question as well. serverfault.com/questions/506426/…
    – TheCleaner
    May 20, 2013 at 18:42

1 Answer 1

Reset to default
1

I still haven't been able to troubleshoot why these policy changes aren't being made on 1 of the 5 DCs, but I was able to work around this problem by running the following auditpol command on it:

auditpol /set /category:"account logon" /subcategory:"kerberos Authentication Service" /success:enable

After refreshing GP and rebooting the DC, the setting is still stuck, so I guess it's not being overwritten anywhere, so I'm calling this good.

Thanks to everyone who read this, and maybe it'll help others in similar situations.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .