Solved

system account changing group policy settings

Posted on 2011-02-24
4
431 Views
Last Modified: 2013-12-04
We use Netwrix to report Group Policy changes and have noticed every few weeks the system account is responsible for changing the 'Audit directory service access' setting  under Computer Configuration (Enabled)/Windows Settings/Security Settings/Local Policies/Audit Policy to No auditing.  Is there a legitimate reason that this would be happening?
 netwrix
0
Comment
Question by:dstewart69
  • 2
4 Comments
 
LVL 51

Expert Comment

by:Netman66
ID: 34980431
No, this isn't normal behaviour.

Does it ever change back with the System account?

What OS is running on your DCs?

In Server 2008 there is a new subcategory for Directory Service Changes that *might* turn off the legacy setting you have if it is configured, but I don't know if you have a mix of 2003 and 2008 DCs.

You might be able to use Auditpol.exe to see additional details.  This tool also has the ability to modify audit policies, so be careful.

0
 

Accepted Solution

by:
dstewart69 earned 0 total points
ID: 34980476
We have been manually changing it back.
We have just recentely added a 2008 DC but this was happening before that.
I will try the Auditpol.exe and see if I can get any more info.
0
 

Author Closing Comment

by:dstewart69
ID: 35252778
No good answer, will just keep manually changing back
0

Featured Post

Backup Your Microsoft Windows Server®

Backup all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

You may have a outside contractor who comes in once a week or seasonal to do some work in your office but you only want to give him access to the programs and files he needs and keep privet all other documents and programs, can you do this on a loca…
While rebooting windows server 2003 server , it's showing "active directory rebuilding indices please wait" at startup. It took a little while for this process to complete and once we logged on not all the services were started so another reboot is …
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

808 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question