Windows Forum

Ask something
Discussion Locked

Auditing impossible on my Win2k Server

0 helpful
8 replies

by johnnyextreme 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I am unable to audit anything on a Win2k member server part of a mixed NT/2000 domain with Win2K PDC. Local security settings for Auditing Object Access is Local settings:Success,Failure Effective settings:Success,Failure. Domain level Group Policy has auditing object access on. When I try to set auditing in security tab of a folder or file it says "The current Audit Policy ...does not have auditing turned on..." I have enabled auditing from admin tools/security policy and from mmc Local Security Policy snapin, and from Group Policy snapin on the PDC. I am also unable to access the Active Directory from this member server, even though it logs onto the domain and shows in Net. Neighborhood. I need to AUDIT!

8 replies

by rob.wilcox1

If you look in AD Users and Computers on your DC what do you see? Have you tried removing the machine from the domain, by removing the account from ADUC, moving the machine back in to a workgroup (from the machine), and re-adding it back to the domain ?

The problem sounds like the OU that the machine account exists in has auditing switched off at that level, and perhaps some other GPO's preventing access?

Thanks

by johnnyextreme

This server is in the only domain in the A.D. and in the O.U. Computers. Right clicking on it to manage and I get 'Computer \\appsvr.delco.com cannot be managed. The network path was not found.' Group Policy / Default Domain Policy has No Override checked and has Audit Object Access enabled, so this should be THE policy.

by johnnyextreme

This server is in the only domain in the A.D. and in the O.U. Computers. Right clicking on it to manage and I get 'Computer \\appsvr.delco.com cannot be managed. The network path was not found.' Group Policy / Default Domain Policy has No Override checked and has Audit Object Access enabled, so this should be THE policy.

by agentj

Auditing is enabled on the domain. If the auditing is disabled on a GPO linked to the OU that contains your member server, then the lower level overrides the domain auditing policy. Domain policy only overrides subordinate policies in a few cases,such as password security settings. Check the OU that this server belongs to and enable auditing on the GPO there. Oh--and don't forget to audit at the resource, not the whole server!

by johnnyextreme

Auditing is enabled in the only GPO in this Domain, which is the default Domain Group Policy. See comments above for more information. I have DDNS problems which may be responsible for this.

by johnnyextreme

I solved this problem by fixing a DNS problem on the PDC. Under TCP/IP advanced settings the 'Use NetBIOS settings from DHCP server' was selected when the DHCP server was the PDC itself. I changed this to Enable NetBIOS over TCP/IP which fixed my DNS and Active Directory problems and allowed this workstation to have policies from the Group Policy Object applied to it.

This discussion is closed to new replies.