Not seeing Group Policy events in security log

For the last few months I've been trying to run some reports on group policy events within our domain. I've insured that logging of group policy events are enabled and have also checked the audit.csv under the sysvol folder. But when I do a search on our Win2k8R2 DC's for events 5130, 5136, 5137, 5138 I'm not seeing anything. I've even made changes to the group policy and waited about 15 minutes and nothing. Appreciate the help.

Thanks.
Richard
RichardPWolfAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

 
Will SzymkowskiSenior Solution ArchitectCommented:
In order for Auditing to work correctly this needs to be setup and configured on the Default Domain Controllers Policy. If this is done correctly you should see those events with no issues.

I would start by taking a look at the below link which detail every step required for this to work properly.
https://technet.microsoft.com/en-us/library/cc731607%28v=ws.10%29.aspx

Will.
0
 
David Paris VicenteSystems and Comunications  Administrator Commented:
Hi Richard,

not even in the Applications and Services Logs/Microsoft/Windows/GroupPolicy?
0
 
RichardPWolfAuthor Commented:
Will review again but have seen that document before.
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

 
RichardPWolfAuthor Commented:
Only the group policy audit messages are not showing up. All other events are working fine.
0
 
RichardPWolfAuthor Commented:
Went through the article and it did help on one aspect that I wasn't looking at for the moment. I still cannot see "any" events relating to group policy changes. i.e. if I make a change to group policy the events don't show up.
0
 
RichardPWolfAuthor Commented:
Over the last couple of days I've made about a half dozen group policy changes and "none" of them showed up in the eventlogs (looked on more than one domain controller). I am getting other events just not "group policy" events.
0
 
Will SzymkowskiSenior Solution ArchitectCommented:
At this point i cannot help any further as this is a straightforward procedure. There must be some other configuration (group policy, security etc) in your domain which you are not seeing or providing details to.

Will.
0
 
RichardPWolfAuthor Commented:
OK thanks. I'm not sure what to look for but I'll drive on.
0
 
RichardPWolfAuthor Commented:
Got my answer. Enhanced logging. It's located under Applications and Services Logs. Now I just need to find out how to access the log from powershell.
0

Experts Exchange Solution brought to you by ConnectWise

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
 
RichardPWolfAuthor Commented:
Enough digging turned up the solution.

Thanks for everyone's help.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.