Auditing with advanced audit policy

Question

I'm looking into advanced audit policy and recommendations.  
What is the difference between "advanced audit policy configuration" and "auditpol.exe?"
Once advanced audit policy is configured, where can I check the logs? Event Viewer?
Should the advanced audit policy be configured on the Default Domain Policy or a separate policy on specific OUs?

Answer 1

Hi,
The basic security audit policy settings in Security Settings\Local Policies\Audit Policy and the advanced security audit policy settings in
Security Settings\Advanced Audit Policy Configuration\System Audit Policies appear to overlap, but they are recorded and applied differently. When you apply basic audit policy settings to the local computer using Local Security Policy, you
are editing the effective audit policy, so changes made to basic audit policy settings will appear exactly as configured in Auditpol.exe.
There are a number of additional differences between the security audit policy settings in these two locations.
There are nine basic audit policy settings under Security Settings\Local Policies\Audit Policy and 53 settings under
Advanced Audit Policy Configuration. The settings available in
Security Settings\Advanced Audit Policy Configuration address similar issues as the basic nine settings in
Local Policies\Audit Policy but allow administrators to be more selective in the number and types of events to audit. For example, where basic audit policy provides a single setting for account logon, advanced audit policy provides four. Enabling
the single basic account logon setting would be the equivalent of setting all four advanced account logon settings. In comparison, setting a single advanced audit policy setting does not generate audit events for activities you are not interested in. In addition,
if you enable success auditing for the basic Audit account logon events setting, only success events will be logged for all account logon–related behaviors. In comparison, you can configure success auditing for one advanced account logon
setting, failure auditing for a second advanced account logon setting, Success and failure auditing for a third advanced account logon setting—or no auditing, depending on the needs of your organization.
The nine basic settings under Security Settings\Local Policies\Audit Policy were introduced in Windows 2000, and therefore are available to all versions of Windows released since then. The advanced audit policy settings were introduced in
Windows Vista and Windows Server 2008. The advanced settings can only be used on computers running Windows 7, Windows Vista, Windows Server 2008 R2, or Windows Server 2008.
For more information, please refer to the below link:
Advanced Security Auditing FAQ
http://technet.microsoft.com/en-us/library/ff182311(WS.10).aspx#BKMK_2
Best Regards,
Yan Li
Yan Li
TechNet Community Support