What is the difference between auditpol and local computer policy?

Current settings:

auditpol -> system audit policy -> logon/logoff:

  • logon: success and failure

local computer policy -> computer configuration -> windows settings -> security settings -> local policies:

  • audit policy folder: no auditing for all settings

windows logs -> security: It is currently showing 'Audit Failure' Event ID 4625 which is what I want for logon failures.

Does auditpol take precedence over local computer policy?

How do you edit the auditpol via 'Group Policy Object Editor'?

  • Have you tried the other way around? I suspect it's not a matter of auditpol taking precedence over local computer policy, but about the "most restrictive" policy being applied, so if you set to audit in one of the consoles, and the other is set to not audit, Windows will audit.
    – curropar
    Apr 26, 2018 at 10:33


You must log in to answer this question.

Browse other questions tagged .