Advance Audit Policy no longer applying after running auditpol.exe /clear

Question

I was troubleshooting some advance group policy issue, some were getting applied some were not. So I ran auditpol.exe /clear in the problematic machine once. And now the advance audit policies are not getting applied even after I run repeated gpupdates & system reboots.

• There are no local policies configured
• I have tried clearing audit.csv from domain GPO, but nothing is working in that machine.
• GPO updates successfully but advance auditing is not applied. All other polices in that GPO do get applied.
• Basic auditing is disabled in GPO and it shows as applied in rsop.msc in the problematic machine.

How can I enable Advance Auditing back after running clear command.

The machine is Windows Server 2019

Answer 1

I got the answer to the problem. Advance Audit policies are only working from Default Domain Policy. If I do the settings on a separate GPO, it is not applying even if I enforce the GPO. Both GPOs are applied on the top domain level, the custom GPO works for other settings but fails for Advance auditing. When the settings are shifted to Default Domain Policy, auditing starts working.

This looks like bug which Microsoft may want to look at or is their any specific reason why this happens.

Answer 2

Advanced Auditing will not work at all if the "Default Domain Policy" is missing its audit.csv file in the SYSVOL folder
{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows NT\Audit

Even policies set locally via secpol.msc won't work!

To restore the audit.csv file, simply edit the "Default Domain Policy" and set any advanced audit setting. This recreates the audit.csv file in the SYSVOL path and you can immediately revert the change to the "Default Domain Policy".

Answer 3

Wanted to chime in here as this thread helped point me in the right direction, I've got a 2012R2 DFL domain and was implementing the Advanced Audit Policies on three different OUs. Unlike the OP I was able to get them working without using the Default Domain Policy entirely. However, there does seem to be a switch of some sort which is triggered by configuring them in the Default Domain Policy. It will become more clear with the review of my process:

1. I backed up all 3 Audit Policy GPOs.
2. Per Microsoft's direction, I deleted all audit.csv files from the %SYSVOL% folder on the domain controller. This
   resets all of the Advanced Audit Policy settings to "Not Configured" in all GPOs. That is
   explained at the bottom of this URL: https://learn.microsoft.com/en-us/previous-versions/windows/it-
   pro/windows-server-2008-R2-and-2008/dd408940(v=ws.10)?redirectedfrom=MSDN
3. On your Default Domain GPO, ensure that Local Policies\Security Options\Audit: Force audit policy subcategory
   settings (Windows Vista or later) to override audit policy category settings is set to Enabled.
4. Configure a single Advanced Audit Policy setting in the Default Domain Policy to Enabled. Just one. This is the "switch" I was referring to.
5. Import the backed up Advanced Audit Policy GPOs into their respective GPOs. Ensure that they are linked to the
   appropriate OUs.
6. Do a gpupdate /force on any systems in the OUs. You'll now see all of your Advanced Audit Policy GPOs configured as intended and using the individually linked OU policies. (versus the Default Domain Policy)

Few things:
a. I've not checked to see if I'm then able to unconfigure the single Advanced Audit Policy setting in the Default Domain GPO and still retain functionality. My gut hunch is that it will revert back, and it's too much of a hassle when it's working fine with the single setting configured.
b. I believe this may be an issue that Microsoft has resolved, per update or subsequent version, however I've not been able to track that down. I've managed other domains with a 2012R2 DFL and above and I've not had the same issue. In other words, yet another thing to remember about Microsoft AD/GPO administration that seems to depend on unknown circumstances and is not as documented. Yay!!!! Lol

-Brent

Answer 4

Hi

Similar problem but I had probably another issue. Audit.csv located on both paths was corrupted (inside was a lot of spaces) so even gpresult showed advanced audit policies assigned it didn't worked. I have no time to study MS documentation but I suppose system tries to merge domain GPO with local and in this case when this file is corrupted shows No auditing for all audits.
To fix it simply overwrite audit.csv files with correct one or even empty (if you want only domain GPO)

Answer 5

Hello,

Thank you so much for your feedback.

So glad to hear that the advanced audit settings started working when they were shifted to Default Domain Policy. If we did the settings on a separate GPO, it would still be applied. Below is my test, and we could kindly have a check.

1, Created the OU (such as OU for computers) and added the computers into this OU.

2, Created a GPO and linked to the above OU (The GPO was named Advanced audit policy).

3, Edited the GPO and configured the settings, such as Audit Credential Validation set to Success and Failure, Audit Security System Extension set to success.

4, Logged on to the computer and refresh the group policy via command gpupdate /force.

5, Checked the gpresult that the GPO was applied successfully.

6, Then check the audit policy via command auditpol /get /category:* and we could see that the settings were applied.

7, Last check the Event Viewer, and we could see that some events were logged.

Hope the information is helpful. Thank you so much for your time.

Best regards,
Hannah Xiong