Hi there,
In Windows 2003 Server, suppose I create a group policy object that enables auditing. Now suppose another administrator changes those settings.
How specifically would I be able to track that? If I am in the GPMC, I can go into the advanced delegation properties for the GPO in question, there is an Auditing tab there. I have a bunch of stuff being audited now (writes and stuff), but when I change the auditing settings in the GPO itself (re: not in delegation), I don't see that change showing up in the event log. Changing a user's password for example does show up immediately though. Do I need to sync the DCs or something for that change to show?
Thanks!
You would have to map that back to the actual object in the sysvol folder