I have a Windows 2003 SP1 server that is a DC in it's own domain with no
other DC's or member servers. When we set an audit policy in the Default DC
policy, the settings are applied. In fact I installed and ran the Grouo
Policy Management Console on this DC and it reports back that the Default
Domain Controllers Policy is the winning policy. I also have no auditing
setup for the Default Domain Policy. I can see the security policy being
applied periodically and no changes take place. The problem occurs when the
server is rebooted. Once the server comes back up, the settings in the
Default Domain Controller Security Policy change ALL the audit settings to
Success, Failure which is not what they were set to before the reboot. I
have checked the file GptTmpl.inf under the sysvol folder and the
gpt00001.inf & tmpgptfl.inf in the C:\WINNT\security\templates\policies and
they all contain the correct audit settings until the server is rebooted.
Anyone have any ideas why my audit settings are changing to Success, Failure
for every audit event after a reboot?
Thanks,
-Mike
|