Advance Audit Policy no longer applying after running auditpol.exe /clear

Question

I was troubleshooting some advance group policy issue, some were getting applied some were not. So I ran auditpol.exe /clear in the problematic machine once. And now the advance audit policies are not getting applied even after I run repeated gpupdates & system reboots.

• There are no local policies configured
• I have tried clearing audit.csv from domain GPO, but nothing is working in that machine.
• GPO updates successfully but advance auditing is not applied. All other polices in that GPO do get applied.
• Basic auditing is disabled in GPO and it shows as applied in rsop.msc in the problematic machine.

How can I enable Advance Auditing back after running clear command.

The machine is Windows Server 2019

Answer 1

I got the answer to the problem. Advance Audit policies are only working from Default Domain Policy. If I do the settings on a separate GPO, it is not applying even if I enforce the GPO. Both GPOs are applied on the top domain level, the custom GPO works for other settings but fails for Advance auditing. When the settings are shifted to Default Domain Policy, auditing starts working.

This looks like bug which Microsoft may want to look at or is their any specific reason why this happens.

Answer 2

Advanced Auditing will not work at all if the "Default Domain Policy" is missing its audit.csv file in the SYSVOL folder
{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows NT\Audit

Even policies set locally via secpol.msc won't work!

To restore the audit.csv file, simply edit the "Default Domain Policy" and set any advanced audit setting. This recreates the audit.csv file in the SYSVOL path and you can immediately revert the change to the "Default Domain Policy".

Answer 3

Hello,

Thank you so much for posting here.

According to our description, we have configured the Advanced Audit policies, and some got applied while some were not. That is to say, there is nothing wrong with the configuration since some got applied. We are wondering whether this GPO is only not applied on the Windows server 2019 machine?

Besides, we mentioned that all other policies in that GPO do get applied. So in the same GPO, there are other policies except the advanced audit policies.

Once we used the Advanced audit policy in the system, the legacy audit policy will not be used by this system. So as mentioned, legacy audit policy is disabled.

Generally we can check if the GPOs are applied via the gpresult. But it is not suitable and accurate to the audit policies. We check the audit policies applying result via the auditpol command:

auditpol /get /category:*

After running the command auditpol.exe /clear, the audit polices will clear. Then we could run gpupdate /force and then the audit policies will come back. For example:

For any question, please feel free to contact us.

Best regards,
Hannah Xiong

Answer 4

Hello,

Thank you so much for posting here.

If we use Advanced Audit Policy Configuration settings, we should enable the Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings policy setting under Local Policies\Security Options. This will prevent conflicts between similar settings by forcing basic security auditing to be ignored. So we have applied this policy and this policy is successfully applied.

The Advanced audit policies are not applied. Would you please kindly run the below command to get the policies report to check whether the specific settings are applied or not? Also please let us know if there is any error messages.

gpresult /h C:\report.html

For example, I configured the advanced audit policies and Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings policy in the same GPO.

Then check the gpresult report, the settings are applied as shown below.

According to our description, we deployed Security Filtering. We could add the group (which you want to apply the policy) with Read and Apply permission.

For Security Filtering, this Group Policy now applies to only computers that are a member of the security group. However we still need to remember that the computer should be part of the site/domain/OU to which this Group Policy Object is linked. We could kindly have a check about this.

For any question, please feel free to contact us.

Best regards,
Hannah Xiong

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 5

Hello,

Thank you so much for your feedback.

So glad to hear that the advanced audit settings started working when they were shifted to Default Domain Policy. If we did the settings on a separate GPO, it would still be applied. Below is my test, and we could kindly have a check.

1, Created the OU (such as OU for computers) and added the computers into this OU.

2, Created a GPO and linked to the above OU (The GPO was named Advanced audit policy).

3, Edited the GPO and configured the settings, such as Audit Credential Validation set to Success and Failure, Audit Security System Extension set to success.

4, Logged on to the computer and refresh the group policy via command gpupdate /force.

5, Checked the gpresult that the GPO was applied successfully.

6, Then check the audit policy via command auditpol /get /category:* and we could see that the settings were applied.

7, Last check the Event Viewer, and we could see that some events were logged.

Hope the information is helpful. Thank you so much for your time.

Best regards,
Hannah Xiong