4

I'm installing vendor software which requires account auditing to be enabled on our DCs. The problem is Audit Policy is not being pushed. Checking secpol.msc shows Windows Settings->Security Settings->Local Policies->Audit Policy as "no auditing". I can not get this to unstick no matter what I do. I've tried:

  • Setting the policy at the Default Domain Controllers level. Currently RSOP is showing this as the winning GPO with Success\Failure correctly being set. On the DC however secpol.msc is showing “no auditing” with greyed out options.
  • We removed the policy from both default domain and defauly domain controlers policy. This allowed us to manipulate the policies locally in secpol.msc. These policies get reverted back to “no auditing” when running a GPUPDATE.
  • We tried setting this at the default domain controllers policy, default domain policy, and a combination of these.
  • We tried disabling "Force Audit Policy" in Windows Settings->Security Settings->Local Policies->Security Options in a variety of places.

There should be no other policies taking precedence and as stated RSOP shows the default domain controllers policy as winning.

I'm normally a Linux administrator and I am at a loss with this. Any help would be appreciated

  • does the output of gpresult /h show the "Advanced Audit Policy Configuration" configured anywhere? – Greg Askew Mar 19 '15 at 16:11
  • @Greg Askew - Yes, in Advanced Audit Configuration->Logon\Logoff, "Audit Accoutn Lockout Policy" is set to success\failure. The winning GPO is default domain controllers. – LinuxAdmin923 Mar 19 '15 at 16:26
2

You may want to review the following warning on the help web site:

"Using both the basic audit policy settings under Local Policies\Audit Policy and the advanced settings under Advanced Audit Policy Configuration can cause unexpected results. Therefore, the two sets of audit policy settings should not be combined. If you use Advanced Audit Policy Configuration settings, you should enable the Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings policy setting under Local Policies\Security Options. This will prevent conflicts between similar settings by forcing basic security auditing to be ignored."

Which Versions of Windows Support Advanced Audit Policy Configuration?
https://technet.microsoft.com/en-us/library/dd692792(WS.10).aspx

  • There was an advanced audit policy configured, the Audit Account Lockout Policy. I removed that but the issue still persisted. Perhaps I had to wait for a replication? Would having this policy on affect other non-advanced audit polices? Next im going to try enforcing an advanced login policy – LinuxAdmin923 Mar 19 '15 at 18:12
2

I found the solution. It was very obscure. After applying the fix everything just worked.

http://blogs.msdn.com/b/spatdsg/archive/2011/06/06/audit-policy-not-registering-audits.aspx

  • Weird. Good find! – joeqwerty Mar 19 '15 at 19:49
  • i know this is from 3 years ago but you should consider describing the actual solution here, and keep the link only as a reference. linked articles have a habit of going away. the preferred stack exchange way to answer is to include the relevant steps in your answer, and refer to the source with a link – JDS Nov 2 '18 at 14:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.