Mistakenly configured advanced audit policies; return to basic?

Solution 1:

Ok it appears that I found the answer. Important to set the subcategory settings to "Disabled". The technet article linked in the comments for the answer suggests an incorrect configuration... That tripped me up for a bit.

From http://jmfcomputers.co.uk/blog/?p=202

In order to roll back you will need to do the following:

◦ Reset all of your local advanced audit settings. If you did this via GPO, reset the settings in this GPO.

◦ On the 2008 machine use “auditpol /clear” to clear any locally set policies.

◦ You must set the local policy “Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings” to DISABLED. When you do this and it is applied you will see the registry key HKLM\SYSTEM\CurrentControlSet\Control\Lsa – SCENoApplyLegacyAuditPolicy = 0 (DWORD)

◦ Then you need to delete the audit.csv files. For domain based policy this will be in SYSVOL

◦ \[Domain]\sysvol[Domain]\Policies{GUID}\Machine\Microsoft\Windows NT\Audit

◦ For local policies delete the Audit.csv from all of these locations. Some may be hidden, but they are there!!

◦ C:\Windows\security\audit

◦ C:\Windows\System32\GroupPolicy\Machine\Microsoft\Windows NT\Audit

Now reboot or “gpupdate /force” and you should be back to the start again.

Incidentally, once you have got the 2008 R2 machine applying the old Audit policies again I would advise setting the policy “Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings” back to the default of not defined. This way when you move forward with the Advanced Audit settings in the future via GPO you will not have cases where 2008 R2 servers that have this setting disabled that were ”fixed” then will not apply the new advanced audit settings. In order to do this just delete the SCENoApplyLegacyAuditPolicy DWORD value. You will see in the local policy that this has set the policy back to “not defined”.

This appears to have restored auditing to the point it was at prior to enabling advanced auditing on our network.