After enabling Advance Audit Policy on the Domain Controllers OU, one of the DCs does not apply the Domain Controllers Audit Policy (every other DCs in the OU does it) and after a quick check, doesn’t apply the Domain Audit policy neither
We have tried already:
Disabling the Advance Audit policy and return to the Basic Audit with no results
Deleting Audit.csv files to “refresh” the Audit settings, after Auditpol /clear, with no results
Stick with the Advacne Audit policy, and force the subcategory settings on the trouble server performing a Auditpol /restore from one of the functioning servers.
After the attempt 3, the trouble server took the correct subcategory audit configuration but it “seems” to be “offline”, as when performing any change to the Advance Audit settings from the GPO interface , the change doesn’t replicate
in the trouble Server.
According to gpresult, the trouble server has not Advance audit policy enabled, when the Advance Audit policy in the Domain Controllers OU is enabled by the DC Audit policy.
Now, another strange thing is, when accessing the local policies (gpedit.msc), the Basic audit local policy is configured as it was in an older version of the Domain Audit policy and cannot be change by any means.
Any idea what else I can do to bring this server from its “offline” Audit Status?
Thanks in advance
PS: I have already applied a lot of suggestions already posted in this forum with no results.
Microsoft is conducting an online survey to understand your opinion of the Technet Web site. If you choose to participate, the online survey will be presented to you when you leave the Technet Web site.