question

ziads-2329 avatar image
0 Votes"
ziads-2329 asked FanFan-MSFT commented

GPO Advanced Audit Policy Settings Not Applied

Hi, I would like to know why my changes to Advanced Audit Policy Configuration in a GPO attached to an OU are not being applied to member servers (running windows server 2016)? I have done everything to check what's going on but I always see local group policy as the wining policy for this setting, but all other changes are successfully applied on the local GP.

  • running the command auditpol.exe /get /category:* shows me totally different settings than what I have in my GPO

  • also checked the results of this command gpresult /H c:\gpresults.html and shows me that for advanced auditing the local policy is winning

  • for some reason my advanced audit changes are not showing under the settings tab when clicking on the GPO in the group policy management

  • I did also enable Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings

windows-active-directorywindows-group-policy
· 1
5 |1600 characters needed characters left characters exceeded
Toggle Comment visibility. Current Visibility: Visible to all users

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

FanFan-MSFT avatar image FanFan-MSFT ·

Hi,
To know the issue more clearly, would you please right click the GPO to save the GPO report and share a screenshot of it？
Also a screenshot of the gpresults.html
Please hide the private information.
Best Regards,

0 Votes 0 ·

1 Answer

Thameur-BOURBITA avatar image
0 Votes"
Thameur-BOURBITA answered FanFan-MSFT commented

Hi,

Check if there is a WMI or group filter set on the GPO.

run the following command to get more details about all GPO settings and filters applied on the server.

 gpresult /H c:\gpresult.html


Please don't forget to mark this reply as answer if it help you to fix your issue

· 4
5 |1600 characters needed characters left characters exceeded
Toggle Comment visibility. Current Visibility: Visible to all users

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

ziads-2329 avatar image ziads-2329 ·

@Thameur-BOURBITA Thank you for the response.

Actually I don't see any filters except on one GPO that has nothing configured related to what im doing, and its not my GPO that im testing.
I have snapshots of the gpo report that I can share, but something interesting im seeing that I haven't checked before is on the local GPO under Extensions Configured I see Audit Policy Configuration and with my basic understanding of GPOs could this be something related to my issue and overwriting my GPO ?

0 Votes 0 ·
FanFan-MSFT avatar image FanFan-MSFT ziads-2329 ·

The local would be applied earlier then the domain GPOs.
So if there are conflicts , the domain GPOs would overwriting the local policy.

0 Votes 0 ·
ziads-2329 avatar image ziads-2329 FanFan-MSFT ·

@FanFan-MSFT this is exactly what is not happening in my case.
No matter what changes I do in the domain GPO advanced audit policy its not overwriting local.
Thats why I mentioned in my response above that the only thing I see on the local GPO is that extension configuration, set to Audit Policy Configuration, and wanted to know if thats something related to my issues in this case ?
I have attached a screenshot
47425-screen-shot-2020-12-09-at-102546-am.png


0 Votes 0 ·
screen-shot-2020-12-09-at-102546-am.png (219.5 KiB)
Show more comments