好吧,似乎我找到了答案.将子类别设置设置为“已禁用”很重要.在回答的评论中链接的
technet article表明配置不正确……这让我感到沮丧.
In order to roll back you will need to do the following:
? Reset all of your local advanced audit settings. If you did this via GPO,reset the settings in this GPO.
? On the 2008 machine use “auditpol /clear” to clear any locally set policies.
? You must set the local policy “Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings” to DISABLED. When you do this and it is applied you will see the registry key HKLMSYSTEMCurrentControlSetControlLsa – SCENoApplyLegacyAuditPolicy = 0 (DWORD)
? Then you need to delete the audit.csv files. For domain based policy this will be in SYSVOL
? [Domain]sysvol[Domain]Policies{GUID}MachineMicrosoftWindows NTAudit
? For local policies delete the Audit.csv from all of these locations. Some may be hidden,but they are there!!
? C:Windowssecurityaudit
? C:WindowsSystem32GroupPolicyMachineMicrosoftWindows NTAudit
Now reboot or “gpupdate /force” and you should be back to the start again.
Incidentally,once you have got the 2008 R2 machine applying the old Audit policies again I would advise setting the policy “Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings” back to the default of not defined. This way when you move forward with the Advanced Audit settings in the future via GPO you will not have cases where 2008 R2 servers that have this setting disabled that were ”fixed” then will not apply the new advanced audit settings. In order to do this just delete the SCENoApplyLegacyAuditPolicy DWORD value. You will see in the local policy that this has set the policy back to “not defined”.
这似乎已将审计恢复到在我们的网络上启用高级审计之前的程度.
