Not seeing Group Policy events in security log
For the last few months I've been trying to run some reports on group policy events within our domain. I've insured that logging of group policy events are enabled and have also checked the audit.csv under the sysvol folder. But when I do a search on our Win2k8R2 DC's for events 5130, 5136, 5137, 5138 I'm not seeing anything. I've even made changes to the group policy and waited about 15 minutes and nothing. Appreciate the help.
Thanks.
Richard
Thanks.
Richard
Hi Richard,
not even in the Applications and Services Logs/Microsoft/Windows/Gro
not even in the Applications and Services Logs/Microsoft/Windows/Gro
ASKER
Will review again but have seen that document before.
ASKER
Only the group policy audit messages are not showing up. All other events are working fine.
ASKER
Went through the article and it did help on one aspect that I wasn't looking at for the moment. I still cannot see "any" events relating to group policy changes. i.e. if I make a change to group policy the events don't show up.
ASKER
Over the last couple of days I've made about a half dozen group policy changes and "none" of them showed up in the eventlogs (looked on more than one domain controller). I am getting other events just not "group policy" events.
At this point i cannot help any further as this is a straightforward procedure. There must be some other configuration (group policy, security etc) in your domain which you are not seeing or providing details to.
Will.
Will.
ASKER
OK thanks. I'm not sure what to look for but I'll drive on.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Enough digging turned up the solution.
Thanks for everyone's help.
Thanks for everyone's help.
I would start by taking a look at the below link which detail every step required for this to work properly.
https://technet.microsoft.com/en-us/library/cc731607%28v=ws.10%29.aspx
Will.