Hello, I am trying to configure a standalone Windows 7 64 bit workstation to meet security policies required by our organization. I am getting stuck trying to enable the settings in the "Audit Policy" section of the local security policy. I have tried setting these both locally by checking the available options, and through the auditpol /set command. In both cases, upon system reboot the policy reverts to "No Auditing" for anything I had set. Please note I am only trying to configure the local audit settings, not the Advanced audit settings. For additional background - I am normally able to configure these settings locally without any issues, but this time I had set various Advanced audit settings beforehand. When I saw that these set the local audit settings to No Auditing, I set all advanced settings back to Not Configured, and changed the local security option "Audit: Force audit policy subcategory settings to override audit policy category settings" to "Disabled". Same result - the local audit policy still says "No Auditing". Is there a step I am missing to be able to reconfigure the local audit policy?

Hi, This type issue occurs may be caused by some domain-based policy prevent the local security auditing settings. You may double check your domain security configuration if the hosts are in the domain environment. Please refer to this. It works for Windows 7 also. http://support.microsoft.com/kb/921468Kim Zhou TechNet Community Support

Hi, No joy so far. This is a standalone workstation - it is not connected to any domain. Running RSOP shows all local security policy as "Not Defined" and I cannot change this. I made sure that the SCENoApplyLegacyAuditPolicy registry key was set to "0" to disable the overwrite policy, then tried to use the auditpol /set /category command to reset the loacal audit policy, but the same result happened: upon restart, all local audit policies reset to "No Auditing".

Hi, Let us check the following setting. 1. Click Start, type in gpedit.msc and press Enter. 2. Navigate to Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options. 3. Find Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings. and ensure this policy has been enabled.Kim Zhou TechNet Community Support