Windows Server Audit Policy Reset
I run across a very strange issue a few days ago and I feel that I should share it with you since it took me some time to figure it out! Some Exchange servers had stopped recording events in the Security log. The first thing that crossed my mind was to check the latest event in the Security log that would probably be the event regarding the audit policy change. I was correct, there were many events with id 4719 that showed that the policy had been changed. The next step would be to update the policy in order to enable auditing. There were servers that had auditing configured according the security baseline so I backed up the auditing configuration from one of them using the command: auditpol /backup /file:C:\Temp\Audit.txt Next I copied the file to the server with the issue and used the command: auditpol /restore /file:C:\Temp\Audit.txt to restore the settings. The command completed successfully and it was time to check the new auditing settings. For this I used the com...