none
Windows Auditing: policy is applied but categories defined in GPO are not.

    Question

  • DC: Server 2012 R2

    Target (Fileserver): Server 2012 R2

    I have a GPO in place that is being applied, and policy is showing up as applied with no errors in RSOP. However, the additional categories set ...\Security Settings\Advanced Audit Policy Configuration are not being set as defined in the GPO. 

    After an auditpol \clear and gpupdate, event 4719 are logged on the target showing that the policy configuration was changed and gives details of categories being set to success/failure. However, not the categories defined in the GPO.

    I have attempted an update of the policy both with Audit: Force Policy subcat settings to Enables and Disabled.

    I gather from scenarios in other forum posts that this may somehow relate to legacy auditing policy, but I am unclear on how to affect this. There is no audit.csv in the sysvol folders on any of my DCs, and I've checked the only other GPO applied to the target (the default domain policy) which does not have these categories defined. I'm super confused, any help appreciated!!

    Thursday, November 17, 2016 10:07 PM

All replies

  • Hi,
    After you disabled the policy “Force audit policy subcategory settings to override audit policy category settings”, have you tried to reboot the computer and see if it works then?
    In addition, we could control this via registry, you could modify the value of SCENoApplyLegacyAuditPolicy entry to 0 under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA
    Please see: https://support.microsoft.com/en-sg/kb/921468
    Best regards,
    Wendy

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    Friday, November 18, 2016 6:53 AM
    Moderator
  • Hi,

    I am checking how the issue going, if you still have any questions, please feel free to contact us.

    And if the replies as above are helpful, we would appreciate you to mark them as answers, and if you resolve it using your own solution, please share your experience and solution here. It will be greatly helpful to others who have the same question.

    Appreciate for your feedback.

    Best regards,

    Wendy


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    Friday, November 25, 2016 7:59 AM
    Moderator