Mastering Active Directory

Enforcing advanced auditing

Before Windows Server 2008, there were nine main auditing categories and subcategories. They still continue to appear under Windows Server 2016. It is recommended not to mix them up and only use advanced auditing. We can enforce the system to only accept advanced auditing policy settings if legacy audit policy settings are applied to the same category.

This can be done by enabling Group Policy setting under Computer Configuration | Windows Settings | Security Settings | Local Policies | Security Options | Audit:Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings.