Local Security Policy -> Audit Policy Settings reset on reboot - Windows Server 2003

I have a file server and try to set Audit Object Access to "Sucess, Failure". The setting is applied and I can then see when files are deleted any who deleted them. However, on a reboot this settings gets reset to "No Auditing".

I did a gpupdate /force to see if that was resetting the Local Security Policy and it isn't. In the event viewer I can see that the settings actually change when the server reboots.
VoeckswAsked:
Who is Participating?
 
VoeckswConnect With a Mentor Author Commented:
There was a Snare Agent on the box that we resetting audit settings.
0
 
intellingenceCommented:
Is this stand alone 2003 server machine?
0
 
VoeckswAuthor Commented:
It's on a domain.
0
The 14th Annual Expert Award Winners

The results are in! Meet the top members of our 2017 Expert Awards. Congratulations to all who qualified!

 
intellingenceCommented:
Have you got any other Group Policy object set for Auditing which might be named inadequately to what it meant to do? Also I'm assuming there is no hardware related problems on your server machine?
0
 
VoeckswAuthor Commented:
I don't have any GPOs set for Auditing. However, this server used to be a Domain Controller and there is a GPO for domain controllers that sets Audit settings. It seems like the old GPO is stuck. I will try to unjoin domain and re-join and see if that fixes the problem.

Any other suggestions on how to get rid of old GPO settings?
0
 
intellingenceCommented:
Hey,

Re-joining to the domain sounds like a good idea. I don't suppose there is a copy of sysvol folder still on this server - delete if there is one. Also is this machine in separate OU to the Domain Controllers?
0
 
VoeckswAuthor Commented:
No other proposed solutions.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.