Unable to set Audit Policy in Local Security Policy
Hello,
I am trying to configure a standalone Windows 7 64 bit workstation to meet security policies required by our organization. I am getting stuck trying to enable the settings in the "Audit Policy" section of the local security policy. I have tried setting
these both locally by checking the available options, and through the auditpol /set command. In both cases, upon system reboot the policy reverts to "No Auditing" for anything I had set. Please note I am only trying to configure the local audit
settings, not the Advanced audit settings.
For additional background - I am normally able to configure these settings locally without any issues, but this time I had set various Advanced audit settings beforehand. When I saw that these set the local audit settings to No Auditing, I set all
advanced settings back to Not Configured, and changed the local security option "Audit: Force audit policy subcategory settings to override audit policy category settings" to "Disabled". Same result - the local audit policy still says "No Auditing".
Is there a step I am missing to be able to reconfigure the local audit policy?
July 2nd, 2012 10:31am
Hi,
This type issue occurs may be caused by some domain-based policy prevent the local security auditing settings. You may double check your domain security configuration if the hosts are in the domain environment.
Please refer to this. It works for Windows 7 also.
http://support.microsoft.com/kb/921468Kim Zhou
TechNet Community Support
Free Windows Admin Tool Kit Click here and download it now
July 3rd, 2012 4:15am
Hi,
No joy so far.
This is a standalone workstation - it is not connected to any domain. Running RSOP shows all local security policy as "Not Defined" and I cannot change this.
I made sure that the SCENoApplyLegacyAuditPolicy registry key was set to "0" to disable the overwrite policy, then tried to use the auditpol /set /category command to reset the loacal audit policy, but the same result happened: upon
restart, all local audit policies reset to "No Auditing".
July 3rd, 2012 7:42am
Hi,
Let us check the following setting.
1. Click Start, type in gpedit.msc and press Enter.
2. Navigate to Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options.
3. Find Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings. and ensure this policy has been enabled.Kim Zhou
TechNet Community Support
Free Windows Admin Tool Kit Click here and download it now
July 9th, 2012 12:35am