I need to implement file / folder auditing for Windows 7-10 workstations so that all access by members of Domain Admins (read, write/modify, create, delete) is logged.
I have enabled "Audit object access" in the group policy and it is in effect (rsop.msc):
I then set the auditing properties for a test folder:
Right-click folder > Properties > Security > Advanced > Auditing tab > click Continue > Add > Domain Admins > Check all for Successful and Failed:
I see a few entries in the Security event log for the setting of the audit properties above (e.g. "Auditing settings on object were changed."), but when I modify or delete a file in that folder, no events are generated in the security log. I also tried to use "Everyone" instead of "Domain Admins" in the auditing settings, but that did not make a difference.
The above test is on Windows 7 Pro x64 SP1 w/ all updates.
What am I missing? How can I get the auditing to work as desired?
-- Update 1 ---
I just tested with a Windows 7 and a Windows 10 machine that are not a member of the AD domain and it worked like a charm!
It is almost as if the "Audit object access" is not in effect (even though it shows as "Success, Failure" in both rsop.msc and "gpresult /z").
Is there something else that I need to do in the GPO or what could be causing this not to take effect?