About the audit log of the domain controller

Question

Windows Server 2019: I am operating a Domain Controller.

I have enabled the audit settings below, but after a certain period of time, the settings return to the default settings.

Policy / Windows Settings / Security Settings / Local Policy / Audit Policy
Account management audit
Define the settings for these policies
Success: Valid
Failure: Valid

Auditing directory service access
Define the settings for these policies
Success: Valid

Do you know any possible causes or remedies?
Thank you.

Answer 1

Hello @ryosk25

You may need to check the Default Domain Controllers Policy: A default GPO that is automatically created and linked to the domain whenever a server is promoted to a domain controller. This GPO represents the default policy that is applied to all domain controllers in the Domain Controllers container. Since the domain policies prevail over local policies, they will rewrite your settings.

To edit this GPO you need to enter the group policy management console from the DC (running GPEDIT from elevated command prompt) and find the GPO from the folders in the left side menu. Once these policies are applied there, will not revert.

More information about precedence and group policy hierarchy: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpod/566e983e-3b72-4b2d-9063-a00ebc9514fd

Hope this helps with your query,

--
--If the reply is helpful, please Upvote and Accept as answer--

Answer 2

Hello @ryosk25 ,

You should check if you have a GPO that override your setting by using gpresult /H gpreport.html.
If it's the case you should create a new GPO linked on the domain controllers OU with a precedence of 1 if possible by using group policy management console (GPMC.MSC) and configure the audit settings as you wish

Regards,