Enable the Global Audit Policy by Using the Windows Interface

11/14/2010 4:39:51 PM

To enable the global audit policy by using the Windows interface, perform the following steps:

1.	Log on to a domain controller or a member computer that has Windows Server 2008 Remote Server Administration Tools (RSAT) installed.
2.	Click Start, click Administrative Tools, and then click Group Policy Management.
3.	In the console tree of the Group Policy Management console, expand the Forest node, expand the Domains node, expand the node for the domain in which you want to configure auditing, and then expand the Domain Controllers node.
4.	Right-click the Default Domain Controllers Policy, shown in Figure 1, and click Edit. Figure 1. The Group Policy Management console. Tip By default, the Default Domain Controllers Policy group policy object (GPO) is linked to the Domain Controllers organizational unit (OU). If you have unlinked this GPO or linked additional GPOs, you need to select the applicable GPO.
5.	In the console tree of the Group Policy Management Editor, expand the Computer Configuration node, expand the Policies node, expand the Windows Settings node, expand the Security Settings node, expand the Local Policies node, and select the Audit Policy node.
6.	In the details pane, right-click Audit directory service access, shown in Figure 2, and click Properties. Figure 2. The Group Policy Management Editor.
7.	On the Audit directory service access page, select Define these policy settings.
8.	As shown in Figure 3, to audit successful directory services access attempts, select Success. To audit failed directory services access attempts, select Failed. Click OK. Figure 3. The Audit directory service access page.
9.	Close the Group Policy Object Editor.

Tip

Changes to GPOs take effect the next time group policy is applied to a user and/or computer. To force the application of a GPO, type gpupdate /force in the command line.