0

Im looking to retrieve the Security audit configuration on a domain joined PC which has audit settings applied Via a domain GPO, but im getting - what seems to be - conflicting results. If i run an RSOP, i see the aduting settings, but Auditpol /get /category:"Logon/Logoff" shows No Auditing. Likewise the local security policy UI, or an secedit export all show No Auditing (AuditLogonEvents = 0). See screenshot below. I know there's a legacy and advanced version of auditing which could be determined by the SCENoApplyLegacyAuditPolicy reg key under HKLM\System\CurrentControlSet\Control\LSA but i dont see the key at all on this machine in question. How could i accurately fetch the auditing settings under any scenario?

enter image description here

enter image description here

0

Auditpol is for Advanced Audit Policy settings.

The policy settings configured in the screenshot are legacy audit policy settings. To view those use:

secedit /export /areas SECURITYPOLICY /cfg Filename.txt

Advanced Audit Policy Configuration

  • Hi Greg, I added a second screenshot which shows that the secedit export is also showing no auditing. – Joe May 24 at 17:54
  • If you want to use legacy audit policies, the registry value needs to be set to 0. – Greg Askew May 24 at 19:38
  • So if i understand you correctly, unless i've got the reg setting set, the audit settings showing in RSOP are not actually applied? – Joe May 24 at 19:40
  • Correct. This has been a well known issue for a long time and is documented here: support.microsoft.com/en-us/help/921468/… . – Greg Askew May 25 at 14:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.