Not seeing Group Policy events in security log

For the last few months I've been trying to run some reports on group policy events within our domain. I've insured that logging of group policy events are enabled and have also checked the audit.csv under the sysvol folder. But when I do a search on our Win2k8R2 DC's for events 5130, 5136, 5137, 5138 I'm not seeing anything. I've even made changes to the group policy and waited about 15 minutes and nothing. Appreciate the help.

Thanks.
Richard
RichardPWolfAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Will SzymkowskiSenior Solution ArchitectCommented:
In order for Auditing to work correctly this needs to be setup and configured on the Default Domain Controllers Policy. If this is done correctly you should see those events with no issues.

I would start by taking a look at the below link which detail every step required for this to work properly.
https://technet.microsoft.com/en-us/library/cc731607%28v=ws.10%29.aspx

Will.
0
David Paris VicenteSystems and Comunications  Administrator Commented:
Hi Richard,

not even in the Applications and Services Logs/Microsoft/Windows/GroupPolicy?
0
RichardPWolfAuthor Commented:
Will review again but have seen that document before.
0
Acronis Data Cloud 7.8 Enhances Cyber Protection

A closer look at five essential enhancements that benefit end-users and help MSPs take their cloud data protection business further.

RichardPWolfAuthor Commented:
Only the group policy audit messages are not showing up. All other events are working fine.
0
RichardPWolfAuthor Commented:
Went through the article and it did help on one aspect that I wasn't looking at for the moment. I still cannot see "any" events relating to group policy changes. i.e. if I make a change to group policy the events don't show up.
0
RichardPWolfAuthor Commented:
Over the last couple of days I've made about a half dozen group policy changes and "none" of them showed up in the eventlogs (looked on more than one domain controller). I am getting other events just not "group policy" events.
0
Will SzymkowskiSenior Solution ArchitectCommented:
At this point i cannot help any further as this is a straightforward procedure. There must be some other configuration (group policy, security etc) in your domain which you are not seeing or providing details to.

Will.
0
RichardPWolfAuthor Commented:
OK thanks. I'm not sure what to look for but I'll drive on.
0
RichardPWolfAuthor Commented:
Got my answer. Enhanced logging. It's located under Applications and Services Logs. Now I just need to find out how to access the log from powershell.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
RichardPWolfAuthor Commented:
Enough digging turned up the solution.

Thanks for everyone's help.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.