Windows – Audit policy being overwritten by “something”

active-directorydomain-controllerwindowswindows-server-2008

I'm installing vendor software which requires account auditing to be enabled on our DCs. The problem is Audit Policy is not being pushed. Checking secpol.msc shows Windows Settings->Security Settings->Local Policies->Audit Policy as "no auditing". I can not get this to unstick no matter what I do. I've tried:

  • Setting the policy at the Default Domain Controllers level. Currently RSOP is showing this as the winning GPO with Success\Failure correctly being set. On the DC however secpol.msc is showing “no auditing” with greyed out options.
  • We removed the policy from both default domain and defauly domain controlers policy. This allowed us to manipulate the policies locally in secpol.msc. These policies get reverted back to “no auditing” when running a GPUPDATE.
  • We tried setting this at the default domain controllers policy, default domain policy, and a combination of these.
  • We tried disabling "Force Audit Policy" in Windows Settings->Security Settings->Local Policies->Security Options in a variety of places.

There should be no other policies taking precedence and as stated RSOP shows the default domain controllers policy as winning.

I'm normally a Linux administrator and I am at a loss with this. Any help would be appreciated

Best Answer

You may want to review the following warning on the help web site:

"Using both the basic audit policy settings under Local Policies\Audit Policy and the advanced settings under Advanced Audit Policy Configuration can cause unexpected results. Therefore, the two sets of audit policy settings should not be combined. If you use Advanced Audit Policy Configuration settings, you should enable the Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings policy setting under Local Policies\Security Options. This will prevent conflicts between similar settings by forcing basic security auditing to be ignored."

Which Versions of Windows Support Advanced Audit Policy Configuration?
https://technet.microsoft.com/en-us/library/dd692792(WS.10).aspx

Related Topic