none
Audit Directory Service Access enabled in Group Policy but shows Not Auditing in Local Security Policy & grayed out

    Question

  • In my Default Domain Controllers Policy, I have Audit Directory Service Access enabled and set to Success.  When I check my domain controllers, in Local Security Policy, it is set to Not Audit and the options are grayed out (I'm assuming because my GPO should overwrite it).  When I check rsop.msc, I can see that it is set to success.

    I'm trying to setup Netwrix Auditing, and it is detecting that it is not enabled.

    Wednesday, April 6, 2016 1:53 PM

Answers

  • Hello,

    As it is grayed out, it is really set by some policy. Can you please run gpresult /scop computer /z and see where this setting comes from? The output of this command will contain information of how this policy gets to your DC.

    Regards

    Wednesday, April 6, 2016 3:15 PM
  • Hi,
    Before going further, please run command auditpol.exe /get /category:* to check the audit settings on the computer.

    Regards,
    Wendy


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, April 8, 2016 8:19 AM
    Moderator

All replies

  • > I'm trying to setup Netwrix Auditing, and it is detecting that it is not
    > enabled.
     
    You'd better ask Netwrix what they are verifying in this detection.
     
    Wednesday, April 6, 2016 3:04 PM
  • Hello,

    As it is grayed out, it is really set by some policy. Can you please run gpresult /scop computer /z and see where this setting comes from? The output of this command will contain information of how this policy gets to your DC.

    Regards

    Wednesday, April 6, 2016 3:15 PM
  • You can also checkout LepideAuditor Suite which should be an appropriate alternative choice for you.
    Thursday, April 7, 2016 7:54 AM
  • Hi,
    Before going further, please run command auditpol.exe /get /category:* to check the audit settings on the computer.

    Regards,
    Wendy


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, April 8, 2016 8:19 AM
    Moderator