Share via

Windows server 2019 the audit policy logon account always change back

Namless Shelter 241 Reputation points
2022-12-09T02:56:49.48+00:00

Dear Friends,

I need a bit help on getting this one right. I tried changed "Local policy - Audit Policy - Audit account Logon event policy event to Success." on our DC server (2019). But every time after it is changed, it will revert back to no auditing. I checked the domain control GP policy (Enforced), it did not have this policy configured. ...

I also tried: disabling: Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings. Still no good...

https://learn.microsoft.com/en-US/troubleshoot/windows-server/windows-security/security-auditing-settings-not-applied-when-deploy-domain-based-policy

However, I noticed another GP policy applied to this OU: Audit directory service access: no auditing. Not sure if it has anything to do with the issue I am having?

Any tips please?

ML

Windows
Windows
A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.
5,824 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,902 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Namless Shelter 241 Reputation points
    2022-12-11T21:56:59.837+00:00

    Any updates friend?

    Thanks

    0 comments
  2. Namless Shelter 241 Reputation points
    2022-12-12T00:04:51.53+00:00

    I also noticed that Advanced Audit Config is enabled on that group policy. Maybe this is the issue?

    Thanks

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.