[gptalk] Re: 'Audit privilege use' won't turn off

  • From: jfvanmeter@xxxxxxxxxxx
  • To: gptalk@xxxxxxxxxxxxx, <gptalk@xxxxxxxxxxxxx>
  • Date: Tue, 05 Aug 2008 17:33:08 +0000

did anyone ever create this reg 
HKLM\System\CurrentControlSet\Control\Lsa\FullPrivilegeAuditing key  I know it 
will enable a ton of user privileges being logged

--
"When the legend becomes fact, print the legend." 


 -------------- Original message ----------------------
From: "Darren Mar-Elia" <darren@xxxxxxxxxx>
> Andrew-
> 
> Strange. What happens if you try disabling it on the local GPO on the
> workstation? 
> 
> 
> Darren
> 
>  
> 
> From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On
> Behalf Of Andrew McHale
> Sent: Tuesday, August 05, 2008 8:20 AM
> To: gptalk@xxxxxxxxxxxxx
> Subject: [gptalk] 'Audit privilege use' won't turn off
> 
>  
> 
> Hi all.
> 
>  
> 
> I have set the attribute "Audit privilege use" to "No auditing" in my
> default domain policy.
> 
>  
> 
> I have run RSOP on a workstation and it confirms this setting is inherited
> from my default domain policy and set to No auditing, yet I still get these
> events appearing in my security log.
> 
>  
> 
> Any idea why?
> 
>  
> 
> Many thanks
> 
>  
> 
> Andrew
> 
>  
>
--- Begin Message ---
  • From: "Darren Mar-Elia" <darren@xxxxxxxxxx>
  • To: <gptalk@xxxxxxxxxxxxx>
  • Date: Tue, 5 Aug 2008 17:23:03 +0000

Andrew-

Strange. What happens if you try disabling it on the local GPO on the workstation?


Darren

 

From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On Behalf Of Andrew McHale
Sent: Tuesday, August 05, 2008 8:20 AM
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] 'Audit privilege use' won't turn off

 

Hi all.

 

I have set the attribute “Audit privilege use” to “No auditing” in my default domain policy.

 

I have run RSOP on a workstation and it confirms this setting is inherited from my default domain policy and set to No auditing, yet I still get these events appearing in my security log.

 

Any idea why?

 

Many thanks

 

Andrew

 


--- End Message ---

Other related posts:

  1. Home
  2. gptalk
  3. Archive
  4. 08-2008