Domain Controller Server 2008 R2 Security Audit Events being removed

Posted on 2011-10-27
Last Modified: 2012-08-13
We have our domain controllers running server 2008 r2 and for some reason it keeps disabling and removing the audit policy from the event viewer.  Whenever our group policy is enforced the auditing is turned on and than a second later the server will automatically remove it again.

Audit Policy Change:
      Category:            Account Logon
      Subcategory:            Kerberos Authentication Service
      Subcategory GUID:      {0cce9242-69ae-11d9-bed3-505054503030}
      Changes:            Failure added

Audit Policy Change:
      Category:            Account Logon
      Subcategory:            Kerberos Authentication Service
      Subcategory GUID:      {0cce9242-69ae-11d9-bed3-505054503030}
      Changes:            Failure removed
Question by:gcgcit
    1 Comment
    LVL 15

    Accepted Solution

    Did you look at to insure this was not your issue?

    Featured Post

    Looking for New Ways to Advertise?

    Engage with tech pros in our community with native advertising, as a Vendor Expert, and more.

    Join & Write a Comment

    Scenario:  You do full backups to a internal hard drive in either product (SBS or Server 2008).  All goes well for a very long time.  One day, backups begin to fail with a message that the disk is full.  Your disk contains many, many more backups th…
    This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…
    With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

    755 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    20 Experts available now in Live!

    Get 1:1 Help Now