2008 R2 SP1 Domain Controllers Local Audit Settings

Question

Question for the forum -- On a DC should the Audit settings in Local Security Policy (under administration tools) match the Audit settings that are set in the Default Domain Controller
policy in Active Directory?
My default domain controller policy has a lot of stuff set for auditing -- when I look at the local policy it shows "No Auditing"  -- I can't change it as I would expect
When I run RSOP.MSC I see that the DC is getting its auditing settings from the Default Domain Controller Policy.
When I look at the event log -- I would expect to see more events being logged -- and I don't.  Its logging events in the security log -- but I don't see anything for account management activities where it set to success & failure
in the default domain controller security policy.
Thanks. 

Answer 1

Hi,  
Did you enable Advanced Audit Policy Configuration? If yes,
The audit policy under Computer Configuration\Polices\Windows Settings\Security Settings\Local Policy will not work.
I recommend you to run command
auditpol.exe /get /category:*to
check the audit policy. If account management policy do not applied, we could check if the following file exists:
Windows\SYSVOL\sysvol\domain name\Policies\ {6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE\Microsoft\ Microsoft NT\ audit.csv
If yes, we could delete it and then refresh the group policy.
For more detailed information about
Audit Policy, please refer to the following link:
Getting the Effective Audit Policy in Windows 7 and 2008 R2
http://blogs.technet.com/b/askds/archive/2011/03/11/getting-the-effective-audit-policy-in-windows-7-and-2008-r2.aspx
Best Regards,
Erin