0

Everyone, Trying to see events in the security event log for every time I change the rights of a user and it doesn't seem to be working.

I've confirmed that setting the above policy settings in the "default Domain controllers policy" policy are applying to my domain controllers using the "group policy results wizard" and I've also confirmed the settings by running secpol. Please see output below:

> C:\Windows\system32>auditpol /get /category:* System audit policy
> Category/Subcategory                      Setting System   Security
> System Extension               No Auditing   System Integrity         
> No Auditing   IPsec Driver                            No Auditing  
> Other System Events                     No Auditing   Security State
> Change                   No Auditing Logon/Logoff   Logon             
> Success and Failure   Logoff                                  Success
> and Failure   Account Lockout                         Success and
> Failure   IPsec Main Mode                         No Auditing   IPsec
> Quick Mode                        No Auditing   IPsec Extended Mode   
> No Auditing   Special Logon                           No Auditing  
> Other Logon/Logoff Events               No Auditing   Network Policy
> Server                   No Auditing Object Access   File System      
> No Auditing   Registry                                No Auditing  
> Kernel Object                           No Auditing   SAM             
> No Auditing   Certification Services                  No Auditing  
> Application Generated                   No Auditing   Handle
> Manipulation                     No Auditing   File Share             
> No Auditing   Filtering Platform Packet Drop          No Auditing  
> Filtering Platform Connection           No Auditing   Other Object
> Access Events              No Auditing   Detailed File Share          
> No Auditing Privilege Use   Sensitive Privilege Use                 No
> Auditing   Non Sensitive Privilege Use             No Auditing   Other
> Privilege Use Events              No Auditing Detailed Tracking  
> Process Termination                     No Auditing   DPAPI Activity  
> No Auditing   RPC Events                              No Auditing  
> Process Creation                        No Auditing Policy Change  
> Audit Policy Change                     Success and Failure  
> Authentication Policy Change            Success and Failure  
> Authorization Policy Change             Success and Failure   MPSSVC
> Rule-Level Policy Change         No Auditing   Filtering Platform
> Policy Change        Success and Failure   Other Policy Change Events 
> No Auditing Account Management   User Account Management              
> Success and Failure   Computer Account Management             Success
> and Failure   Security Group Management               Success and
> Failure   Distribution Group Management           Success and Failure 
> Application Group Management            Success and Failure   Other
> Account Management Events         Success and Failure DS Access  
> Directory Service Changes               Success and Failure  
> Directory Service Replication           Success and Failure   Detailed
> Directory Service Replication  Success and Failure   Directory Service
> Access                Success and Failure Account Logon   Kerberos
> Service Ticket Operations      No Auditing   Other Account Logon
> Events              No Auditing   Kerberos Authentication Service     
> No Auditing   Credential Validation                   No Auditing

I always do a gpupdate /force after I update any policy settings.

But, when I create a new policy, and change a user right, no 4704 events are generated. A search for the affected username in the event log doesn't bring up anything either. To make the change, I create a new policy and link to it at the top of the GPO tree in the Group Policy Management snap-in. Next, I go to Computer Configuration->Policies->Security Settings->Local Policies->User Rights Assignment and change "Act as part of the operating system" so that it's defined, and I add an AD user to the list.

No 4704 event though. All I see is:

 An operation was performed on an object.

 Subject :  Security ID:        ScrubbedDomainName\ScrubbedSourceUserID
    Account Name:       ScrubbedSourceUserID    Account
 Domain:        ScrubbedDomainName  Logon ID:       0x4a9248

 Object:    Object Server:      DS  Object Type:        user    Object
 Name:      CN=scrubbed target user
 name,CN=Users,DC=ScrubbedDomainName,DC=ScrubbedSuffix  Handle ID:      0x0

 Operation:     Operation Type:     Object Access   Accesses:       Control Access
                    Access Mask:        0x100   Properties:     Control Access      {91e647de-d96f-4b70-9557-d63ff4f3ccd8}
            {6617e4ac-a2f1-43ab-b60c-11fbd1facf05}
            {b3f93023-9239-4f7c-b99c-6745d87adbc2}
            {b8dfa744-31dc-4ef1-ac7c-84baf7ef9da7}
            {b7ff5a38-0818-42b0-8110-d3d154c97f24}
        {771727b1-31b8-4cdf-ae62-4fe39fadf89e}
            {612cb747-c0e8-4f92-9221-fdd5f15b550d}
    {bf967aba-0de6-11d0-a285-00aa003049e2}


 Additional Information:    Parameter 1:        -   Parameter 2:

Which corresponds to the change I made.

The only events before and after are logon and logoff events.

Seeing all sorts of other events such as logon and logoff events though. Something else I should be doing? Something else I should check?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.