4

I'm installing vendor software which requires account auditing to be enabled on our DCs. The problem is Audit Policy is not being pushed. Checking secpol.msc shows Windows Settings->Security Settings->Local Policies->Audit Policy as "no auditing". I can not get this to unstick no matter what I do. I've tried:

  • Setting the policy at the Default Domain Controllers level. Currently RSOP is showing this as the winning GPO with Success\Failure correctly being set. On the DC however secpol.msc is showing “no auditing” with greyed out options.
  • We removed the policy from both default domain and defauly domain controlers policy. This allowed us to manipulate the policies locally in secpol.msc. These policies get reverted back to “no auditing” when running a GPUPDATE.
  • We tried setting this at the default domain controllers policy, default domain policy, and a combination of these.
  • We tried disabling "Force Audit Policy" in Windows Settings->Security Settings->Local Policies->Security Options in a variety of places.

There should be no other policies taking precedence and as stated RSOP shows the default domain controllers policy as winning.

I'm normally a Linux administrator and I am at a loss with this. Any help would be appreciated

2
  • does the output of gpresult /h show the "Advanced Audit Policy Configuration" configured anywhere?
    – Greg Askew
    Mar 19, 2015 at 16:11
  • @Greg Askew - Yes, in Advanced Audit Configuration->Logon\Logoff, "Audit Accoutn Lockout Policy" is set to success\failure. The winning GPO is default domain controllers. Mar 19, 2015 at 16:26

3 Answers 3

3

You may want to review the following warning on the help web site:

"Using both the basic audit policy settings under Local Policies\Audit Policy and the advanced settings under Advanced Audit Policy Configuration can cause unexpected results. Therefore, the two sets of audit policy settings should not be combined. If you use Advanced Audit Policy Configuration settings, you should enable the Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings policy setting under Local Policies\Security Options. This will prevent conflicts between similar settings by forcing basic security auditing to be ignored."

Which Versions of Windows Support Advanced Audit Policy Configuration?
https://technet.microsoft.com/en-us/library/dd692792(WS.10).aspx

1
  • There was an advanced audit policy configured, the Audit Account Lockout Policy. I removed that but the issue still persisted. Perhaps I had to wait for a replication? Would having this policy on affect other non-advanced audit polices? Next im going to try enforcing an advanced login policy Mar 19, 2015 at 18:12
2

I found the solution. It was very obscure. After applying the fix everything just worked.

https://web.archive.org/web/20150613060638/http://blogs.msdn.com/b/spatdsg/archive/2011/06/06/audit-policy-not-registering-audits.aspx

2
  • Weird. Good find!
    – joeqwerty
    Mar 19, 2015 at 19:49
  • 1
    i know this is from 3 years ago but you should consider describing the actual solution here, and keep the link only as a reference. linked articles have a habit of going away. the preferred stack exchange way to answer is to include the relevant steps in your answer, and refer to the source with a link
    – JDS
    Nov 2, 2018 at 14:39
0

Blog referred above is now at: https://docs.microsoft.com/en-us/archive/blogs/spatdsg/audit-policy-not-registering-audits

Solution references finding "audit.csv" files blocking application of audit policy, removing files resulted in proper audit policies applied. Files found at:

C:\Windows\system32\grouppolicy\machine\microsoft\windows nt\audit\audit.csv

C:\Windows\security

M:\SYSVOL\domain\Policies{CEF3323C-FD89-4C03-9410-18F7A4922E5A}\Machine\microsoft\windows nt\Audit

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .