<div>
<div class="content wysiwyg-content">
We have our domain controllers running server 2008 r2 and for some reason it keeps disabling and removing the audit policy from the event viewer. &nbsp;Whenever our group policy is enforced the auditing is turned on and than a second later the server will automatically remove it again.<br />
<br />
Audit Policy Change:<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Category: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Account Logon<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Subcategory: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Kerberos Authentication Service<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Subcategory GUID: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{0cce9242-69ae-11d9-bed3-5<wbr />0505450303<wbr />0}<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Changes: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Failure added<br />
<br />
Audit Policy Change:<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Category: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Account Logon<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Subcategory: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Kerberos Authentication Service<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Subcategory GUID: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{0cce9242-69ae-11d9-bed3-5<wbr />0505450303<wbr />0}<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Changes: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Failure removed
</div>
</div>


We have our domain controllers running server 2008 r2 and for some reason it keeps disabling and removing the audit policy from the event viewer.  Whenever our group policy is enforced the auditing is turned on and than a second later the server will automatically remove it again.

Audit Policy Change:
	Category:		Account Logon
	Subcategory:		Kerberos Authentication Service
	Subcategory GUID:	{0cce9242-69ae-11d9-bed3-505054503030}
	Changes:		Failure added

Audit Policy Change:
	Category:		Account Logon
	Subcategory:		Kerberos Authentication Service
	Subcategory GUID:	{0cce9242-69ae-11d9-bed3-505054503030}
	Changes:		Failure removed

Domain Controller Server 2008 R2 Security Audit Events being removed

The Microsoft Legacy Operating System topic includes legacy versions of Microsoft operating systems prior to Windows 2000: All versions of MS-DOS and other versions developed for specific manufacturers and Windows 3/3.1, Windows 95 and Windows 98, plus any other Windows-related versions, and Windows Mobile.

Microsoft Legacy OS

Active Directory (AD) is a Microsoft brand for identity-related capabilities. In the on-premises world, Windows Server AD provides a set of identity capabilities and services, and is hugely popular (88% of Fortune 1000 and 95% of enterprises use AD). This topic includes all things Active Directory including DNS, Group Policy, DFS, troubleshooting, ADFS, and all other topics under the Microsoft AD and identity umbrella.

Active Directory

Windows Server 2008 and Windows Server 2008 R2, based on the Microsoft Vista codebase, is the last 32-bit server operating system released by Microsoft. It has a number of versions, including including Foundation, Standard, Enterprise, Datacenter, Web, HPC Server, Itanium and Storage; new features included server core installation and Hyper-V.