Reverting from advanced audit policies back to basic

Hey,
I'm trying to revert back to basic audit policies after using advanced polies. The policy is set locally on the DC server 2012. I've tried doing this:
http://support.microsoft.com/kb/921468. There are no advanced polices set. When I set the basic policies they are good until the next gupdate, then they revert "no configured"
So what ever reason my firewall can only pull signed on users from the basic audit policies and not advanced. Any idea how to revert this?

Ok, so I got it figured out.
For anyone else to reference:
http://technet.microsoft.com/en-us/library/ff182311(v=ws.10).aspx
In this document they mention:
How can I roll back security audit policy from Advanced Audit Policy to basic audit policy?
Applying advanced audit policy settings replaces any comparable basic security audit policy settings. If you subsequently change the advanced audit policy setting to Not configured, you will need to complete the following steps to restore the original
basic security audit policy settings:
Set all Advanced Audit Policy sub-categories to Not configured.
Delete all audit.csv files from the %SYSVOL% folder on the domain controller.
Reconfigure and apply the basic audit policy settings.
Unless you complete all of these steps, the basic audit policy settings will not be restored.
But my issue was a local policy and not in sysvol. I found 2 file locations.
C:\Windows\security\audit\audit.csv
C:\Windows\System32\GroupPolicy\Machine\Microsoft\Windows NT\Audit\audit.csv
Once I renamed those files. Then I could use basic audit policies again.

Similar Messages

  • Reverting from Creative Cloud Membership back to perpetual license?

    Will Creative Cloud subscribers have the option to purchase a CS7 perpetual license upgrade if they find they no longer wish to pay a monthly subscription?

    I would also like to have this answered.
    So far, I'm not entirely satisfied with Creative Cloud.
    I know its too early to tell and there's a lot of room to improve, and I would like to think that Adobe will continue to polish it, but when you depend on their tools to make a living, I just cannot hold the idea that a server problem, some glitch on their end or something totally unexpected can render the apps unusable (just have a look at this forums and all the problems with activations and one issue with a sudden deactivation). I know that the software-as-a-service (SaaS) is a trend that is here to stay (and grow), but I think there's still a lot of ironing and things to fix to us costumers to really adopt it.
    Although I took the introductory offer for current customers (yes, I decided to give Adobe the chance), after seeing how the "opening weekend" went, I've been thinking to upgrade my copy of CS 5.5 to a pereptual CS6 (or CS7) license before the suscription ends... I would like to think of it as an "insurance policy" for a worst case scenario: a failure on Adobe´s end on a tight deadline (Murphy's Law, anyone?). However, if what the sales rep told Stipple3D it's true, I'll be more than happy to "return" my Creative Cloud subscription during the 30-days "grace period" and go the usual way.
    While I understand (and somewhat agree) that first-time CC costumers are not eligible for an "exit-route" from it, I really believe that loyal users of Adobe, the ones that have been paying them for each release, should always have an exit-route if their interests and satisfaction are not totally meet by Creative Cloud.
    Hope we receive a coherent and respectful reply soon...
    Regards,

  • AF:Query  Reset when mode changes from Advanced to Basic

    Hi,
    Can you please suggest how i can reset the af:query when i toggle from Advanced to Basic.
    The Problem is : User goes to Advanced tab and selects "NOT IN" and searches for the data..
    Now he switch backs to Basic Mode.. though it doesn't show the "Prefix "NOT IN" it still searches with the clause "NOT IN" . Basically user needs to reset and then start searching in "Basic" mode.
    Please suggest.

    Hi,
    When i try to programmatically reset the table, it does reset it but the problem is after resetting if enter a search criteria and click on search again, nothing shows up.
    If i do a search before clicking on reset, it works fine, but afer reset the search stops working??
    Any idea why this could be happening?
    Following is teh reset code which i am refereing
        if(QueryOperationEvent.Operation.RESET.equals(queryOperationEvent.getOperation())){
          AppModuleImpl am = this.getAm();
          ViewObject submittalVO = am.findViewObject("AcrSubmittallogView1");
           submittalVO.setNamedWhereClauseParam("bind_date", "");
           submittalVO.executeQuery();
           AdfFacesContext.getCurrentInstance().addPartialTarget(resId1);
        queryOperationEvent.getComponent().processUpdates(FacesContext.getCurrentInstance()); 
    on the jspx page, have added the following code in af:query component
      <af:query id="qryId1" headerText="Search" disclosed="true"
                                  value="#{bindings.ImplicitViewCriteriaQuery.queryDescriptor}"
                                  model="#{bindings.ImplicitViewCriteriaQuery.queryModel}"
                                  queryListener="#{bindings.ImplicitViewCriteriaQuery.processQuery}"
                                  *queryOperationListener="#{backingBeanScope.backing_SubmittalLog.resetListener}"*
                                  binding="#{backingBeanScope.backing_SubmittalLog.q1}"
                                  resultComponentId="::resId1"
                                  saveQueryMode="hidden" />Thanks
    ashvini

  • Is there anyway I can use my iPod Touch serial number or Apple ID to trace and find back my iPod Touch? Cause I lost it recently(as you know iPod Touch can only go online if there is WiFi). is there any other ways too, apart from contacting the police?

    Is there anyway I can use my iPod Touch serial number or Apple ID to trace and find back my iPod Touch? Cause I lost it recently(as you know iPod Touch can only go online if there is WiFi). is there any other ways too, apart from contacting the police?Is there anyway I can use my iPod Touch serial number or Apple ID to trace and find back my iPod Touch? Cause I lost it recently(as you know iPod Touch can only go online if there is WiFi). is there any other ways too, apart from contacting the police?

    No.
    - If you previously turned on FIndMyiPod on the iPod in Settings>iCloud and wifi is on and connected go to iCloud: Find My iPhone, sign in and go to FIndMyiPhone. If the iPod has been restored it will never show up.
    iCloud: Find My iPhone
    - You can also wipe/erase the iPod and have the iPod play a sound via iCloud.
    - If not shown, then you will have to use the old fashioned way, like if you lost a wallet or purse.
    - Change the passwords for all accounts used on the iPod and report to police
    - There is no way to prevent someone from restoring the iPod (it erases it) using it unless you had iOS 7 on the device. With iOS 7, one has to enter the Apple ID and password to restore the device.
    - Apple will do nothing without a court order                                                        
    Reporting a lost or stolen Apple product                                               
    - iOS: How to find the serial number, IMEI, MEID, CDN, and ICCID number

  • Round tripping from Premiere CC to Audition CC back to Premiere-no video

    My last big project was on Adobe CS6 and roundtripped from Premiere to Audition and back to Premiere and it all worked out great. Been doing the recent project with Premiere CC to Audiition CC. Made the audio adustments in Audition, saved, etc and went to export under Multitrack>Premiere Pro(and keeping the individual stems).  When I saw the new sequence in PP project panel and opened it up, but all I got were the edited audio tracks, but no video. I tried it three times and the same thing happened. I can't send out the finished movie without the video. And I won't start over and copy and paste the video over the new audio sequence(still on seperate video tracks before the final tweaking). What was changed from CS6 to CC?

    Not a direct reply to your question but...
    I have only exported video to Audition as a reference track- preferring to use the PP timeline for the master export.  I somehow feel it's less prone to image quality loss (codec dependent!)
    To that end, I add the imported Audition mix-down either as a single or multiple stems, depending upon the project requirements,  and place them in sync in the original timeline.

  • Can I revert from CC back to CS6?

    I received a file I couldn't read (as I am running CS6) so I downloaded a trial version of CC to read the file and save it to CS6. But after that, CC subsumed my CS6 as the default application and without me realizing it saved 14 of my source packaged files as CC—now I cannot open them.  I am furious!  What can I do?  I refuse to be manipulated into the "CLOUD" until I am ready!   I already uninstalled CC...

    shuk108 wrote:
    Can I revert from CC back to CS6?
    Yes, you didn't mention which Creative Cloud tools or trials you were using, but Cozmicone is right – for most Adobe CC apps you can downsave the file back to be openable in older CS6, CS5, CS4 or CS3 versions of the programs... although newer features that weren't present in earlier releases will not be supported.

  • How can i revert from iOS 5 back to iOS 4.3

    how can i revert from iOS 5 back to iOS 4.3?

    my handsfree in the car worked fine until i installed the ios5.1 update and now although it says its connected iy drops the connection if someone calls.
    having looked online it seems to be a common fault with this update so really om looking to go back to a previous ios to allow it to work again

  • How do I revert my iWeb published site (the actual published site in internet is up to date) the one on my repaired computer is old from a time machine back-up and out of date?

    The question is above I repaired my hardrive and the iweb site is from an old time machine back-up. In the web my site is up to date and I want to update my computer stored iWeb site to the site in internet ?

    You need to copy and paste the content from the published files back into iWeb and recreate any missing pages since iWeb has no import facility.

  • Domain advanced audit policy not taking effect on DC.

    Hi.
     I'm having a strange problem getting an advance audit policy to take effect on one of my domain controllers, we'll call it DC1. I have two DCs on this network, and both are in the same OU, however behave wildly differently with the same policy.
    For example, on DC1 when I run group policy results wizard from GPMC, I can see the local policy/audit policy settings, but no settings for advanced audit configuration are shown. However, if I log into DC1 itself and look at local security policy,
    it shows settings in both areas.
    No matter what changes I made to either area in the domain policy nothing would change in the local security policy on the system when refreshing group policy on the DC. It was as if it were stuck somehow. If I used the auditpol /get /category:* command
    it showed default audit settings, and that's it.
    I figured I would try to clear them and set them manually, and so I did an auditpol /clear, and now it says No Auditing for all categories. In addition to this, I did a gpupdate /force and it still said no auditing in all cagegories after displaying them
    with auditpol /get /cagories:*. On DC2 which is in the same OU, when running the group policy result wizard, it shows both advance audit, and basic auditing settings being applied.
    If I look in the local security policy it shows no auditing for all basic audit settings, and all the advanced audit settings as being set. Which should be the case when Audit: force audit policy subcategory settings is set (which it is). However, unlike
    DC1, instead of showing No auditing, it shows all of the advanced audit configuration settings when I type auditpol /get /categories: * at the command prompt, and it's gpresults look good. I even cleared the audit policy off of DC2, and got it to show "no
    auditing" before doing a gpupdate, and all it's settings came back. Not so with DC1. DC1 seems to apply all other group policy settings without issue.

    Hi,
    Based on your description, we can use the command auditpol/clear to remove all audit settings, find the audit.csv file existing in the GPOs in which we configured audit settings,
    delete the audit.csv file, and then configure the audit setting via group policy to see if it works as expected.
    The path for the audit.csv file:
    %systemroot%\Sysvol\sysvol\domainname\Policies\GPOs\Machine\
    Microsoft\Windows NT\Audit
    In addition, regarding audit policy, the following blog can be referred to for more information.
    Getting the Effective Audit Policy in Windows 7 and 2008 R2
    http://blogs.technet.com/b/askds/archive/2011/03/11/getting-the-effective-audit-policy-in-windows-7-and-2008-r2.aspx
    TechNet Subscriber Support
    If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.
    Best regards,
    Frank Shen

  • Advanced Audit Policy in Windows 2008R2

    Hi,
    This is in regards to Advanced Audit Policy configurations in Windows 2008R2.
    1. What is the correct way to configure the Audit policies if we have to audit mix of settings from both Legacy & Advanced policies..? For example I would like to audit Account lockouts from Advanced policy along with existing Legacy settings.
    2. When I tried last time, the moment I enable Account lockout setting, none of the Legacy settings are applying to the DC.
    3. Ned has confirmed this behaviour in his article but his suggestion in such case is to DISABLE the setting “Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings”
    http://blogs.technet.com/b/askds/archive/2011/03/11/getting-the-effective-audit-policy-in-windows-7-and-2008-r2.aspx
    3. If we DISABLE the specified security setting - both the settings from Legacy & Advanced policies will get applied as long as there is no conflict, but in case of a conflict, Legacy policy will take precedence over Advanced policy. Is my understanding
    correct..?
    Thanks in advance for your help!
    Ashok

    Hi Ashok,
    Yes, you understand this policy correctly.
    By default, if you define a value for a policy in one of the top-level categories—either in the computer's Local Security Policy or in an applicable GPO—then that top-level
    policy will usually override any configurations that you make at the subcategory level with the auditpol command. In other words,  setting audit policy by using basic audit policy categories will override the subcategory audit policy
    settings in Advanced Audit Policy Configuration. Enabling the
    Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings policy setting allows audit policy to be managed by using subcategories without requiring a change to Group Policy. 
    Regards,
    Lany Zhag

  • Auditing with advanced audit policy

    I'm looking into advanced audit policy and recommendations.  
    What is the difference between "advanced audit policy configuration" and "auditpol.exe?"
    Once advanced audit policy is configured, where can I check the logs? Event Viewer?
    Should the advanced audit policy be configured on the Default Domain Policy or a separate policy on specific OUs?

    Hi,
    The basic security audit policy settings in Security Settings\Local Policies\Audit Policy and the advanced security audit policy settings in
    Security Settings\Advanced Audit Policy Configuration\System Audit Policies appear to overlap, but they are recorded and applied differently. When you apply basic audit policy settings to the local computer using Local Security Policy, you
    are editing the effective audit policy, so changes made to basic audit policy settings will appear exactly as configured in Auditpol.exe.
    There are a number of additional differences between the security audit policy settings in these two locations.
    There are nine basic audit policy settings under Security Settings\Local Policies\Audit Policy and 53 settings under
    Advanced Audit Policy Configuration. The settings available in
    Security Settings\Advanced Audit Policy Configuration address similar issues as the basic nine settings in
    Local Policies\Audit Policy but allow administrators to be more selective in the number and types of events to audit. For example, where basic audit policy provides a single setting for account logon, advanced audit policy provides four. Enabling
    the single basic account logon setting would be the equivalent of setting all four advanced account logon settings. In comparison, setting a single advanced audit policy setting does not generate audit events for activities you are not interested in. In addition,
    if you enable success auditing for the basic Audit account logon events setting, only success events will be logged for all account logon–related behaviors. In comparison, you can configure success auditing for one advanced account logon
    setting, failure auditing for a second advanced account logon setting, Success and failure auditing for a third advanced account logon setting—or no auditing, depending on the needs of your organization.
    The nine basic settings under Security Settings\Local Policies\Audit Policy were introduced in Windows 2000, and therefore are available to all versions of Windows released since then. The advanced audit policy settings were introduced in
    Windows Vista and Windows Server 2008. The advanced settings can only be used on computers running Windows 7, Windows Vista, Windows Server 2008 R2, or Windows Server 2008.
    For more information, please refer to the below link:
    Advanced Security Auditing FAQ
    http://technet.microsoft.com/en-us/library/ff182311(WS.10).aspx#BKMK_2
    Best Regards,
    Yan Li
    Yan Li
    TechNet Community Support

  • How do I revert from Mavericks to Mt. Lion?

    I have tried the suggestions contained in similar threads without success.  My configuration may be causing problems.  Here is my configuration and the pathway I would like to use:
    As shown below, I have a MacPro early 2008 running OSX 10.9.  I have an iPhone 4S running iOS 7.0.3.  I back up Time Machine to an external hard drive and also to a separate internal hard drive that occupies one of the bays on my Mac Pro, but it is NOT the same hard drive on which Mavericks resides.
    Before migrating from Mountain Lion 10.8.5 to Mavericks, I did a final backup of Time Machine to each of the two drives mentioned above.  I then proceeded to install Mavericks 10.9.  For me, this was a mistake.  I normally wait until at least three updates have occurred before moving up to the next OS X offering.  The many flaws I have encountered in the way Mavericks currently operates have funally exhausted my patience and I must revert to 10.8.5.
    I would like to make the change using Time Machine for both the Mountain Lion operating system and all of the applications and documents.  If I were going to reinstall Snow Leopard 10.6.8, I would start by reinstalling the OS using the DVD which I have and then I would restore the apps and documents from Time Machine.  However, neither Mavericks nor Mountain Lion have DVDs.  I believe that they both can be installed by Time Machine, but this is where I run aground. I don't know how to make it happen.  I have tried and have been hindered by popup windows telling me I can't change the Applications.  I can't go on from there. I would prefer to dowload from the hard drive version of Time Machine rather than the external drive for the simple reason that the internal hard drive is faster.  If that is not advisable, I am certainly willing to go with the external drive.  It is my understanding that I can restore Mountain Lion directly from Time Machine along with all of the documents and other stored items such as Applications, Library, etc.
    I have tried to do this, but can't seem to get the hang of it.  I need a tutor who knows how to do the job using this path.  Assistance will be greatly appreciated.

    A SIMPLE METHOD FOR REVERTING FROM MAVERICKS BACK TO AN EARLIER OS X VERSION
    There were so many caveats and side issues included on various instructions that didn't apply to me that I thought it was a bit confusing. However, I got the idea that restarting while pressing down the option key would give me access to the Recovery drive. I tried it and it gave me several choices. The top one was irresistible. It says "Restore From Time Machine Backup." I had done full backups using Time Machine to both an internal hard drive on my MacPro and an external hard drive just before installing Mavericks. I clicked on "Restore From Time Machine Backup" and selected the external drive since I wasn't sure that the internal drive would work. The internal backup drive is faster, but I felt the external drive was a safer bet. A window came up asking me to choose which backup I wanted to use. I picked the one I made just before installing Mavericks and it went to work. It took a couple of hours to finish, but as it restarted and Mountain Lion 10.8.5 appeared on the screen, I was totally relieved. I feel liberated. Everything works. No wacky glitches to say "gotcha!"
    When you consider all of the written instructions, many of which are very difficult to follow, this very simple method of restoration is amazingly easy. I hope it helps others who are considering moving to OS X 10.9. Just get a good external Time Machine backup of your present system before you venture.

  • Trying to install all my MP3s from new external drive back into iTunes

    Hi,
    I'm hoping anyone can help me out here...
    I had a major PC upset and have had to rebuild it from scratch (with the help of Dell Tech Support!).
    I've now downloaded and installed latest version of iTunes and I'm trying to reload all of my (thankfully) saved MP3s, still in their relevant folders etc, from my external HD back into iTunes.
    Despite all attempts, it isn't happening!
    Short of having to 'open with' (Tunes) each and every single file, can anyone help with how I can do this?
    Thanks in advance for all help offered!
    Cheers, Robin
    Dell Dimension 8250   Windows XP  

    I just seen your post here, I'll reply the rest of what I was talking about here

  • How do i change from OS-X mavericks back to mountain lion

    how do i change from OS-X mavericks back to mountain lion i dont like maverick and i want to go back to snow lion BUT I want all my stuff (pictures, docs, ect.) im running bootcamp with windows 8 also, and dont even work or load, it just keeps looping or restarting windows updates

    Here's a reference: How to revert OS X back from Mavericks: Apple Support Communities

  • From which table  feed back partner and root cause partner

    hi,
    can any body tell me ,from which table  feed back partner and root cause partner
    can be find.
    i need to add this in datasource 0crm_sales_act_1.
    thanks in advance.
    regards,
    sridhar M

    It is always advsible to use function modules in CRM instead of making direct table access. Unlike R/3, CRM tables and buffering are quite complex.
    In your case, to read the values of maintained Sales Areas, use the function module <h5>CRMA_BUPA_GET_SALES_AREAS</h5>
    The function module takes the BP Guid (BUT000-PARTNER_GUID)
    However you can also find your information in tables<h5>
    CRMM_BUT_LNK0011 - BP Sales rule list
    CRMM_BUT_LNK0010 - BP Sales rule list
    CRMM_BUT_SET0010 - BP Sales rule set</h5>
    Hope this helps.
    Easwar Ram
    http://www.parxlns.com

Maybe you are looking for

  • Smt data from diagnostics

    Hello, Can anyone interpret the following info from the diagnostics run on my 20G ipod? The 'smt data' returned with the following: retracts 84 reallocs 227 pending 541 This was immediately after I reformatted the ipod. The HDD R/W passes and all oth

  • What file size is used for "optimized" upload/download?

    When I upload my photo files from Aperture (and previously from iPhoto) I routinely use the upload setting named "dowloading of optimized" files.  I know that this downsizes the files for faster upload/download, but still gives a file size acceptable

  • How i can see the Current Order documents

    Hi Gurus, can any body  tell me how can i see the current order number documents? in T.Code - KONK  i see that the number range status shows current order document number. but i cannt trace where it to see the document? also i check the Order Actual

  • I purchased a movie but its not fully purchased, how can I re-install it ?

    I purchased a movie but its not fully purchased, how can I re-install it ?

  • 10g DB on SPARC

    Hi, I've been trying in vain to properly install 10g Database on a Solaris workstation running Solaris 9 (with the appropriate patches). It is a stand alone workstation with no NIC, and the installation fails on bind. I check the SQLnet.log when crea