Mistakenly configured advanced audit policies; return to basic?

Question

I can't believe I did this... I set an advanced auditing policy in our GPO and it shut down all of our basic policies. From Technet:

After you apply advanced audit policy settings by using Group Policy, you can only reliably set system audit policy for the computer by using the advanced audit policy settings.

It seems odd to me that there isn't a way to say, "Nevermind, roll back to basic auditing". We won't be restoring the whole network to old backups as it's been too long since the change was put in place.

A similar question was asked here on serverfault but the answer seems to be "configure advanced auditing to perform the same way". I will do that if I have no other choice, but I would prefer to actually restore basic auditing.

Answer 1

Ok it appears that I found the answer. Important to set the subcategory settings to "Disabled". The technet article linked in the comments for the answer suggests an incorrect configuration... That tripped me up for a bit.

From http://jmfcomputers.co.uk/blog/?p=202

In order to roll back you will need to do the following:

◦ Reset all of your local advanced audit settings. If you did this via GPO, reset the settings in this GPO.

◦ On the 2008 machine use “auditpol /clear” to clear any locally set policies.

◦ You must set the local policy “Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings” to DISABLED. When you do this and it is applied you will see the registry key HKLM\SYSTEM\CurrentControlSet\Control\Lsa – SCENoApplyLegacyAuditPolicy = 0 (DWORD)

◦ Then you need to delete the audit.csv files. For domain based policy this will be in SYSVOL

◦ \[Domain]\sysvol[Domain]\Policies{GUID}\Machine\Microsoft\Windows NT\Audit

◦ For local policies delete the Audit.csv from all of these locations. Some may be hidden, but they are there!!

◦ C:\Windows\security\audit

◦ C:\Windows\System32\GroupPolicy\Machine\Microsoft\Windows NT\Audit

Now reboot or “gpupdate /force” and you should be back to the start again.

Incidentally, once you have got the 2008 R2 machine applying the old Audit policies again I would advise setting the policy “Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings” back to the default of not defined. This way when you move forward with the Advanced Audit settings in the future via GPO you will not have cases where 2008 R2 servers that have this setting disabled that were ”fixed” then will not apply the new advanced audit settings. In order to do this just delete the SCENoApplyLegacyAuditPolicy DWORD value. You will see in the local policy that this has set the policy back to “not defined”.

This appears to have restored auditing to the point it was at prior to enabling advanced auditing on our network.

Answer 2

Actually for me, all it took was to roll back the Registry setting; that set the subcategories back to "Not Audited". BTW, the location in a Local Policy Editor MMC view (gpedit.msc or secpol.msc) corresponding to the Registry setting mentioned above: under "Computer Configuration->Windows Settings" (if in "gpedit.msc"), navigate to "Security Settings->Local Policies->Security Options", setting "Audit: Force audit policy subcategory settings". To bear this out, I 1st dumped the advanced subcat settings to a CSV: auditpol.exe /backup /file:<path\>AuditPolicy.csv. The top 5 settings ("IPsec Driver", "System Integrity", "Security System Extension", "Security State Change", "Other System Events") were the same advanced subcat settings under "...Security Settings->Advanced Audit Policy Configuration->System Audit Policies-Local Group Policy Object->System". The values in the CSV file reflected the default values in the Local Pol Editor, respectively: 3, 3, 1, 1, 3 (1="Success", 3="Success/Failure"). Then I set "Audit: Force audit policy subcategory settings" (path noted earlier) in Local Pol Editor MMC, rebooted (required to take effect), then reran auditpol.exe /backup /file:<path\>J:\AuditPolicy.csv to dump the advanced pol settings again: all 5 top values were then 0.

Answer 3

I had a problem with the default domain policy after someone turned on advanced auditing.

Before you begin copy the default policy or policy you are working on by right clicking on it in the group policy objects folder then right click on the group policy objects folder and paste. (This will not link the copy.) This is to reference later for settings you want to recreate.

The Fix is to find the policy in sysvol to do this select the policy in group policy editor. Go to the right side and select the details tab. The details in here show the hash name of the folder in C:\windows\sysvol\sysvol\yourdomain.dom\policies\

Find the hash folder with that name and find and remove the audit folder. It contains the same .csv mentioned above ^. You will now have to put in the default lockout, password, kerberos, audit, and event log settings. This will stop the advanced audit issue from happening.