Solved

Group Policy applying but not changing settings :(

Posted on 2015-01-15
3
945 Views
Last Modified: 2015-01-21
Thank you for this urgent help. Auditors checking this out tomorrow morning.

We have a GPO that sets the eventlog audit settings for success or failure security events. The scope is set to Authenticated Users.

When I run the group policy wizard in GPMC it shows the settings applying to one of our servers in that OU.

When I run gpresult/z from that server it shows the policy applying to that server.

But when I go into gpedit.msc the security audit settings are all set to "not defined" and they are grayed out so I can't edit them manually.

As a test I set the GPO to deny applying to that server. I ran gpudpate/force on the system and then gpresult and it shows the GPO now not applying. But the settings are still set to not defined and still not editable. they are not being set by any other GPO.

In the event logs I only see three GPO errors but they are unrelated. A separate GPO is having issues creating user accounts. No other GPOs apply.

Quick help would be fantastic.

Server runs on Windows Server 2008 R2 (I can edit GPO but not the domain ones and I don't have access to the domain controllers).
0
Comment
Question by:DITGUY
  • 2
3 Comments
 
LVL 24

Expert Comment

by:VB ITS
Comment Utility
But when I go into gpedit.msc the security audit settings are all set to "not defined" and they are grayed out so I can't edit them manually.
There's your problem. gpedit.msc is used to modify the Local Computer Policy, not policies in Group Policy. You need to use the Group Policy Management Console (or GPMC for short) to modify the Group Policies.

If you don't have access to the Domain Controller and need to modify GPOs from your 2008 R2 server then you can install the GPMC through Server Manager. See this article for the steps to do this: http://technet.microsoft.com/en-us/library/cc725932.aspx
0
 

Accepted Solution

by:
DITGUY earned 0 total points
Comment Utility
OK, After several hours I figured it out. Turns out there's bugs and odd functionality.

If someone ever tested the 'advanced audit settings' (which I did in the same GPO at some point) then it sets a registry key to disable the use of the older basic audit settings. But when you stop using those advanced settings in your GPO it doesn't remove that registry bit. So I used the GPO to undo that setting. This was the first step. This is found Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" to DISABLED.

Even though this is done, sometimes the GPO files on the domain controllers don't remove the old audit settings. So in the comments of another thread I found out you may have to go to \\domain-fqdn\SYSVOL\domain-fqdn\Policies\{your-policy-id-where-this-setting-was-originally-set}\Machine\Microsoft\Windows NT\ and delete the Audit folder which is left behind due to some odd bug. If you don't do this even after doing the next step the next gpupdate will bring that security setting above back down.

Next you have to reset your audit settings on your PC to the defaults. Unfortunately there is no way to do this. Auditpol /clear does not accomplish this. The only way to do this is to take the audit settings from another working system, export them and then 'restore' those same settings to the affected server. To do this:

1. On 'working system' run cmd.exe as administrator and export the audit settings to a folder like this:
auditpol /backup /file:c:\working-auditpol-settings.txt

2. Copy that file to the broken system such as the C:\ drive and run this on the broken system:
auditpol /restore /file:c:\working-auditpol-settings.txt

Open GPEDIT.MSC and verify the audit settings are back to normal. Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy

Then run gpupdate/force on the formerly broken system. Close gpedit.msc and reopen and verify the settings were not overwritten. If you skipped the sysvol audit folder deletion step they may come back.

Hope this helps someone.
0
 

Author Closing Comment

by:DITGUY
Comment Utility
Figured out answer on my own. See above.
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
Synchronize a new Active Directory domain with an existing Office 365 tenant
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…
This tutorial will give a short introduction and overview of Backup Exec 2012 and how to navigate and perform basic functions. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as conne…

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now