As the title says, the O/S is Enterprise Server 2008 SP2. Currently this server is setup as a DC and DNS Server. The GPO is setup to audit sucess / failure for logon events, account logon events, and object access. From a workstation I can login and the log will show the audit sucess for the logon, but it shows a NULL SID. When I log off it gives me the sucessful audit with the SID field for the domain account I just logged off of. So my first question is: Is it normal for the SID to be NULL during a succesfully login? Next, and honestly the issue I consider the biggest problem at the moment is: When I type in and incorrect password for any domain account, it does not show the the audit failure in the logs. The GPO doesn't allow me to log in, which is great. but I still don't receive that audit failure in the logs on the DC. Oddly enough if I attempt to login under the local user for the workstation, and type an incorrect password, the DC does log the audit failure for the local user account on the workstation. I've been reading support docs for hours with no luck. Any help would be greatly appreciated.

Hi, According to the description, this issue is related to GPO, please ask in GPO forum. http://social.technet.microsoft.com/Forums/en/winserverGP/threads