Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium


Domain Controller Server 2008 R2 Security Audit Events being removed

Posted on 2011-10-27
Medium Priority
Last Modified: 2012-08-13
We have our domain controllers running server 2008 r2 and for some reason it keeps disabling and removing the audit policy from the event viewer.  Whenever our group policy is enforced the auditing is turned on and than a second later the server will automatically remove it again.

Audit Policy Change:
      Category:            Account Logon
      Subcategory:            Kerberos Authentication Service
      Subcategory GUID:      {0cce9242-69ae-11d9-bed3-505054503030}
      Changes:            Failure added

Audit Policy Change:
      Category:            Account Logon
      Subcategory:            Kerberos Authentication Service
      Subcategory GUID:      {0cce9242-69ae-11d9-bed3-505054503030}
      Changes:            Failure removed
Question by:gcgcit
1 Comment
LVL 15

Accepted Solution

WalkaboutTigger earned 2000 total points
ID: 37041230
Did you look at http://support.microsoft.com/kb/921468 to insure this was not your issue?

Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Resolving an irritating Remote Desktop connection that stops your saved credentials from being used.
Wouldn't it be nice if objects in Active Directory automatically moved into the correct Organizational Units? This is what AutoAD aims to do and as a plus, it automatically creates Sites, Subnets, and Organizational Units.
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…

564 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question