Audit Policy Change -- Audit Failure Event

hi,

 i configure log audit policy change failure events only.

computer configuration -> windows settings -> security settings -> advanced audit policy configuration -> system audit policies -> policy change -> "audit audit policy change" "failure"

i need conform failure event logs or not.  after setting policy failure, did't failure logs.

in scenario failure log audit policy change.

thank you,

hi,
first of all, before go further, please verify gpo applied clients successfully, run gpresult /r command check that.
if gpo not applied, please follow article below troubleshoot it:
10 common problems causing group policy not apply
http://social.technet.microsoft.com/wiki/contents/articles/22457.10-common-problems-causing-group-policy-to-not-apply.aspx
in addition, in order failure log, must take failure action in following aspects:
• permissions , audit settings on audit policy object (by using auditpol /set /sd).
• changing system audit policy.
• registration , de-registration of security event sources.
• changing per-user audit settings.
• changing value of crashonauditfail.
• changing audit settings on object (for example, modifying system access control list (sacl) file or registry key.)
please see: https://technet.microsoft.com/en-us/library/dd772736%28v=ws.10%29.aspx?f=255&mspperror=-2147217396
best regards,
wendy

---

please remember mark replies answers if help.
if have feedback technet subscriber support, contact tnmff@microsoft.com. 

Windows Server  >  Group Policy