After you apply advanced audit policy settings by using Group Policy,you can only reliably set system audit policy for the computer by using the advanced audit policy settings.
对我来说似乎很奇怪,没有办法说,“没关系,回到基本的审计”.我们不会将整个网络恢复到旧备份,因为自更改实施以来已经太久了.
在服务器故障中询问了similar question,但答案似乎是“配置高级审计以执行相同的方式”.如果我别无选择,我会这样做,但我更愿意实际恢复基本审计.
从http://jmfcomputers.co.uk/blog/?p=202开始
In order to roll back you will need to do the following:
◦ Reset all of your local advanced audit settings. If you did this via GPO,reset the settings in this GPO.
◦ On the 2008 machine use “auditpol /clear” to clear any locally set policies.
◦ You must set the local policy “Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings” to DISABLED. When you do this and it is applied you will see the registry key HKLM\SYSTEM\CurrentControlSet\Control\Lsa – SCENoApplyLegacyAuditPolicy = 0 (DWORD)
◦ Then you need to delete the audit.csv files. For domain based policy this will be in SYSVOL
◦ \[Domain]\sysvol[Domain]\Policies{GUID}\Machine\Microsoft\Windows NT\Audit
◦ For local policies delete the Audit.csv from all of these locations. Some may be hidden,but they are there!!
◦ C:\Windows\security\audit
◦ C:\Windows\System32\GroupPolicy\Machine\Microsoft\Windows NT\Audit
Now reboot or “gpupdate /force” and you should be back to the start again.
Incidentally,once you have got the 2008 R2 machine applying the old Audit policies again I would advise setting the policy “Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings” back to the default of not defined. This way when you move forward with the Advanced Audit settings in the future via GPO you will not have cases where 2008 R2 servers that have this setting disabled that were ”fixed” then will not apply the new advanced audit settings. In order to do this just delete the SCENoApplyLegacyAuditPolicy DWORD value. You will see in the local policy that this has set the policy back to “not defined”.
这似乎已将审计恢复到在我们的网络上启用高级审计之前的程度.
