Local policy not reflecting applied GPO

Question

I run gpresult to make sure the right GPO is the winning one and compared some audit related settings to what the GPO has set. For some reason I see that lots of GPO flags are not reflected in local policy. E.g. Object Access if said to Failed in the GPO yet checking in local policy it's has No Auditing set. Same goes for various Advanced audit configurations. What could be causing such deviation and how can this be fixed?

Answer 1

audit policy is special. Local Security Policy may not be accurate to see the 'effective' policy.
instead, try:
auditpol /get /category:*

https://support.microsoft.com/en-us/topic/2f6a528c-9ef5-8ab5-e3ca-f7856f5bf5fc

https://web.archive.org/web/20190322031949/https://blogs.technet.microsoft.com/askds/2011/03/11/getting-the-effective-audit-policy-in-windows-7-and-2008-r2/

Answer 2

Hello,

Thank you for your question.

I would like to suggest you open run as Admin from cmd and you will see all gpo being applied and gpo name which override aswell.

C:> gpresult /h c:\temp\gpresult.html

If the reply was helpful, please don’t forget to upvote or accept as answer.

Thanks,

PRAKASH T

Answer 3

Indeed auditpol shows all the flags set as expected whereas gpedit doesn't which is a bit of a shame.