none
Advanced Audit policy with legacy audit policy, legacy not applying

    Question

  • OK, so, one of our clients is insisting on using the classic audit policy settings alongside some of the advanced audit policy settings... I set the "Audit: Force audit policy subcategory settings" policy to Disabled, to allow for the legacy settings to apply. I also have each of the Audit Policy settings customized, and I have approximately 9 policies set in three categories under the Advanced Audit Policy Configuration.

    After running gpupdate /force, I'm seeing the correct items show up when I run "auditpol /get /category:*", but I'm not seeing the legacy Audit Policy settings being applied. I'm checking by going into gpedit.msc, drilling down to the .\Local Policies\Audit Policy folder, and they're all set to "No auditing", but is there a better, or more accurate way to verify this?

    I see where the legacy Audit Policy settings are set in two different GPO's, but they're both set identically. Also, I see that the "Audit: Force audit policy subcategory settings" setting is applied in two different GPO's, but again, they're both set identical, to disabled.

    I just can't figure out why the legacy Audit settings aren't being applied...any help would be appreciated.

    Monday, July 13, 2015 7:36 PM

Answers

All replies