locked
how to stop event 4719 RRS feed

  • Question

  • I tried to make some changes to my group policies that are in place in regards to auditing, now i keep getting event logs for event 4719 from my servers due to various auditing now being turned off. How do i somehow set that to be the current baseline and not report changes again until it changes from this current version?
    Sunday, February 5, 2012 1:37 AM

Answers

All replies

  • What audit policies did you change when the 4119's started? 
    Monday, February 6, 2012 5:26 AM
  • I was trying to enable advanced auditing to stop alerts about windows platform filtering blocking packets. I think my problem was that basic auditing was trying to set object access to report failure then the advanced was telling it to not autdit is, so it would flip flop on that. turned off all basic auditing, set everything in advanced and turned off notifications of changes to audit policy and deleted the audit.csv. Going to give that a few days to make sure it doesn't bitch to me anymore then will try to turn on the notification of changes and see if it is done reporting the 4719s all the time.

    Wednesday, February 8, 2012 1:08 AM
  • Hi,

    Using both advanced and basic audit policy settings can cause unexpected results. If you use Advanced Audit Policy Configuration settings or use logon scripts (for computers running Windows Vista or Windows Server 2008) to apply advanced audit policy, be sure to enable the Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings policy setting under Local Policies\Security Options. This will prevent conflicts between similar settings by forcing basic security auditing to be ignored.

    For more information, please refer to:

    Advanced Security Auditing FAQ
    http://technet.microsoft.com/en-us/library/ff182311(WS.10).aspx

    Advanced Security Auditing in Windows 7 and Windows Server 2008 R2
    http://social.technet.microsoft.com/wiki/contents/articles/advanced-security-auditing-in-windows-7-and-windows-server-2008-r2.aspx

    Hope this helps.

    Regards,
    Bruce

    • Marked as answer by Bruce-Liu Tuesday, February 28, 2012 10:04 AM
    Thursday, February 9, 2012 10:48 AM