The advanced audit polices have been set in a GPO that is applied to our 2008 servers but they are not in local security policy or a registry check by nessus. Settings seem to be applied if you look at eventviewer but there is no way to confirm for compliance. I read in http://support.microsoft.com/kb/921468 that the force audit policy should be disabled. Making that change did not affect the settings. I read if GP is applied that has the regular audit policy setting set to a 2008 computer you will get mixed results. Can anyone confirm removing and audit settings from GPs that are applied to 2008 will fix my issue? Thanks, Cindy

Hi, If you are using Group Policy to apply the advanced audit policy settings and global object access settings, client computers must be running Windows Server 2008 R2 or Windows 7. Which Versions of Windows Support Advanced Audit Policy Configuration? http://technet.microsoft.com/en-us/library/dd692792(WS.10).aspx To apply advanced audit polity to Windows Server 2008, you need to use the auditpol.exe utility. For example, you can run auditpol /get to display the current audit policy on the local computer.This posting is provided "AS IS" with no warranties, and confers no rights.

I am talking about 2008 R2 servers, the auditpol utility shows the correct settings but Local Security policy does not. Why doesn't it change setting in local policy? Nessus policy scan comes up with failure. Thanks for the info.

I am having the same problem. Our auditors are having difficulty certifying that the subcategory audit settings are actually set. I am hoping that someone from Microsoft can shed some light on this situation. Furthermore, having a mixed environment of XP/2003 and Win7/R2 means having both category and subcategory audit policy settings enabled. This type of environment doesn't seem to work well for the Win7/R2 member computers. Thanks for listening.