• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 958
  • Last Modified:

Domain Controller Server 2008 R2 Security Audit Events being removed

We have our domain controllers running server 2008 r2 and for some reason it keeps disabling and removing the audit policy from the event viewer.  Whenever our group policy is enforced the auditing is turned on and than a second later the server will automatically remove it again.

Audit Policy Change:
      Category:            Account Logon
      Subcategory:            Kerberos Authentication Service
      Subcategory GUID:      {0cce9242-69ae-11d9-bed3-505054503030}
      Changes:            Failure added

Audit Policy Change:
      Category:            Account Logon
      Subcategory:            Kerberos Authentication Service
      Subcategory GUID:      {0cce9242-69ae-11d9-bed3-505054503030}
      Changes:            Failure removed
0
gcgcit
Asked:
gcgcit
1 Solution
 
Darrell PorterEnterprise Business Process ArchitectCommented:
Did you look at http://support.microsoft.com/kb/921468 to insure this was not your issue?
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now