Event ID's 107 & 113 Source: Microsoft-Windows-Security-Audit-Configuration-Client

Question

I'm getting a ton of these in the Event logs. The description says:

Failed to downloaded the audit settings file as follows.

Remote File: \Domain.local\sysvol\Domain.local\Policies{6AC1786C-016F-11D2-945F-00C04fB984F9}\Machine\Microsoft\Windows NT\Audit\audit.csv

Local File: C:\Windows\security\audit\audit.csv

GPO Name: Default Domain Controllers Policy

Error: 0x2

The only "audit.csv" I have is here:

C:\Windows\SYSVOL_DFSR\domain\Policies{BD61C12C-A9FC-4DFB-BABA-6F1C27132DDC}\Machine\Microsoft\Windows NT\Audit\audit.csv

I'm not sure where in the GPO this is referenced and even if I do how to rectify it.

Anyway, we are not feeling any adverse effects that I can see due to this error, but I would like to eliminate it if possible. It seems, on the surface, it is just case of finding where this pointer is in group policy and correcting it to point to the correct location where audit.csv lives.

Thanks for your thoughts

Answer 1

Hello

The error messages you’re seeing in the Event logs are related to the Microsoft-Windows-Security-Audit-Configuration-Client. The system is trying to download an audit settings file (audit.csv) from a Group Policy Object (GPO) but is failing to do so.

 

The error message indicates that the system is looking for the audit.csv file in the \\Domain.local\sysvol\Domain.local\Policies{6AC1786C-016F-11D2-945F-00C04fB984F9}\Machine\Microsoft\Windows NT\Audit\ directory, but it’s not finding it there. Instead, you mentioned that the audit.csv file is located in the C:\Windows\SYSVOL_DFSR\domain\Policies{BD61C12C-A9FC-4DFB-BABA-6F1C27132DDC}\Machine\Microsoft\Windows NT\Audit\ directory.

 

Here are some steps you can take to resolve this issue:

 

Check the GPO settings: The error message mentions the “Default Domain Controllers Policy”. You can check this policy in the Group Policy Management Console (GPMC) to see if it’s referencing the correct path for the audit.csv file.

 

Move the audit.csv file: If the GPO is indeed looking for the audit.csv file in the wrong location, you could try moving (or copying) the audit.csv file to the directory that the system is checking.

 

Update the GPO: If the GPO is pointing to the wrong location for the audit.csv file, you might need to update the GPO to point to the correct location.

Answer 2

Can you point me to where the setting is in the Default Domain Policy? I find nothing there referencing Audit.csv and I can find no way to search in the GPM.