×
INTELLIGENT WORK FORUMS
FOR COMPUTER PROFESSIONALS

Contact US

Log In

Come Join Us!

Are you a
Computer / IT professional?
Join Tek-Tips Forums!
  • Talk With Other Members
  • Be Notified Of Responses
    To Your Posts
  • Keyword Search
  • One-Click Access To Your
    Favorite Forums
  • Automated Signatures
    On Your Posts
  • Best Of All, It's Free!

*Tek-Tips's functionality depends on members receiving e-mail. By joining you are opting in to receive e-mail.

Posting Guidelines

Promoting, selling, recruiting, coursework and thesis posting is forbidden.

Students Click Here

DC Event logs auditing cannot be set by GPO

DC Event logs auditing cannot be set by GPO

DC Event logs auditing cannot be set by GPO

(OP)
I need to retrieve weekly reports of failed user logins from our Win2016 Domain Controllers.

The problem is that the event logs are filling up within minutes with Directory Service Access entries.

I have checked the Default Domain Controllers GPO and Auditing of Directory Service Access was not configured. I disabled it and also disabled "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" on the advice from here: https://docs.microsoft.com/en-us/troubleshoot/wind... , then did a gpresult /force.

I then did a Group Policy Result and it shows that the setting is being applied, but the logs still fill up within seconds. They are set at about 128mb. I increased to 1Gb but it still fills up within minutes.

Now here is the thing: All the Directory Service entries are for accessing our Exchange server. I have looked at the logs there and there are corresponding entries.

My questions are: How to do I break the link between the two event logs? or Can I safely switch of this logging on the Exchange server?

Thanks

Andy

RE: DC Event logs auditing cannot be set by GPO

Microsoft has been trying to secure the event logs for a little while now. While it's true that GPO can force settings on local machine, that's not something Microsoft will allow their users to do. The settings can only be enforced by Group Policy. We have in the past seen GPO's that were designed to allow trusts to do this. You can get write my assignment help to manage your education. Therefore it's safe to say that it's quite impossible to set a local checkbox on a GPO that you want to enforce in your organization

Red Flag This Post

Please let us know here why this post is inappropriate. Reasons such as off-topic, duplicates, flames, illegal, vulgar, or students posting their homework.

Red Flag Submitted

Thank you for helping keep Tek-Tips Forums free from inappropriate posts.
The Tek-Tips staff will check this out and take appropriate action.

Reply To This Thread

Posting in the Tek-Tips forums is a member-only feature.

Click Here to join Tek-Tips and talk with other members! Already a Member? Login

Close Box

Join Tek-Tips® Today!

Join your peers on the Internet's largest technical computer professional community.
It's easy to join and it's free.

Here's Why Members Love Tek-Tips Forums:

Register now while it's still free!

Already a member? Close this window and log in.

Join Us             Close