GPO applied successfully but not working

Question

I have enabled Audit Logon Events (Success, Failure) in the Default Domain Controller Policy. But there is no eventID 4624 even though I tried logging out and in. I checked on Local Security Policy the status is "No auditing" even though GPO is applied. Thanks a lot.

Answer 1

Hello Tin Huynh,

Thank you for posting in Q&A forum.

Based on the description, how did you configure the
Audit Logon Events (Success, Failure) within the Default Domain Controller Policy?

Legacy audit policy or advanced audit policies? Here is the advanced audit policies and Legacy audit policy.

Legacy audit policy:

Computer Configuration\Windows settings\security settings\local policies\audit policy

Audit Account Logon Events – Success and Failure

Advanced audit policies:

Or use advanced audit policies (advanced audit policies will overwrite all legacy audit policies by default once you enable any one advanced audit policy):

Computer Configuration\Windows settings\security settings\Advanced Audit Policy Configuration\Logon/Logoff:

Audit Logon – Success and Failure

Note:
1.If you have never configured any advanced audit policy before, then you configure the legacy audit policy.

2.If you have configured any advanced audit policy before, then you have configured the advanced audit policy.

3.Once you configured any one advanced audit policies, then all legacy audit policies will be overwritten by default.

If you configured by advanced audit policy, please run command gpupdate /force

to refresh GPO on DC and run command auditpol /get /category:* on DC to view the advanced audit policy we configured.

After you configured Audit Logon Events (Success, Failure) within the Default Domain Controller Policy, you can try to sign in Domain Controller using domain Administrator or domain user account to see if you can see event ID 4625 (sigin in failure) or 4624 (sign in success).

I hope the information above is helpful.

If you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

==========================================

If the Answer is helpful, please click "Accept Answer" and upvote it.