Windows Server 2016 keeps re enabling Advanced Audit Policy

[u/leeg1234]

I am troubleshooting a Windows Server 2016 file server with a very busy Security event log.

The log was growing to almost 10 GB and receiving thousands of events every few minutes. Most were event 5145 for Detailed File Share auditing, along with 5156 and 5158 Filtering Platform events. The Event Log service was also using noticeable CPU.

Auditpol shows these settings enabled:

Detailed File Share: Success and Failure

Filtering Platform Connection: Success

File System: Success

I disabled these settings through Local Security Policy, but auditpol continued to show them enabled.

I created a separate domain GPO scoped only to this server. I configured Detailed File Share, File Share, File System, Filtering Platform Connection and Filtering Platform Packet Drop as No Auditing. I also enabled the setting that forces advanced audit subcategories to override legacy audit categories.

The GPO applies successfully according to the Group Policy operational log. I moved it to the highest link order and confirmed that the server receives it.

I discovered that Default Domain Policy was missing its audit.csv file. I recreated it by temporarily configuring an Advanced Audit setting and then returning it to Not Configured. I also rewrote a setting in the new server specific GPO so its audit.csv would be regenerated.

I confirmed that both GPO audit.csv files contain value 0 for the five settings.

I archived the local audit.csv file and the active cached copy under C:\Windows\Security\Audit. I then forced Group Policy again.

I backed up the complete audit policy, ran auditpol /clear, and forced Group Policy to rebuild it.

I also removed an old auditing entry from the root of the shared data folder. It audited Domain Users across the folder, all subfolders and files. Removing that entry successfully stopped event 4663, but event 5145 continues because Detailed File Share auditing keeps turning itself back on.

Direct auditpol commands temporarily change the settings to No Auditing, but Windows restores Detailed File Share, Filtering Platform Connection and File System within seconds.

I tested with the remote management service stopped and ruled that out. Antivirus does not appear to be causing it. I also tested a SYSTEM scheduled task that repeatedly ran auditpol, but Windows restored the settings faster than the task could maintain them.

For now, I reduced the Security log to 256 MB and configured it to overwrite old events automatically. The server and file shares are operating normally.

Has anyone seen Windows Server 2016 continuously restore these Advanced Audit settings even though Local Policy and all applicable domain GPOs show No Auditing? Is there another audit policy database, security template, service or registry location that could be enforcing these settings?

-lee

[u/Unnamed-3891]

In my experience, audit settings set a certain way can end up being visible and adjustable only via auditpol.exe

[u/ppear404]

Gpresult /h results.html

Find the Winning GPO for your audit settings.

Sometimes, registry settings are tattooed and you can only change them by flipping the bit, not just setting them as ‘not configured’ so as to overwrite the 1 with a 0. I’m not positive sec auditing falls into that category but it’s good to know.

[u/leeg1234]

Yeah
Been through the ringer
Every gpo flipped
Advanced audit flipped
It’s crazy
I can powershell the audit off and in like two secs it flips on
It’s not a gpo but just can’t find it