Forum Discussion

justletmelogin50's avatar
justletmelogin50
Brass Contributor
Apr 01, 2025

Event 4719 Audit policy changed

Hi all,

Windows domain with 2 Server 2019 domain controllers.

All our computers (including the DC's) are showing multiple events 4719 Audit policy changed, everytime they update group policy, and logon events are no longer being logged.

Example below of one of the events.  There appears to be one for each Category of this type of event.

System audit policy was changed.
 
Audit Policy Change:
Category: Account Management
Subcategory: Other Account Management Events
 
Changes: Success removed, Failure removed
 
When running RSOP on the Domain Controllers it shows our Default Domain Controllers Policy applying for Windows Settings/Security Settings/Local Policies/Audit Policy with the various Auditing policies enabled.
Here is a screenshot of RSOP from one of the DC's.  GPRESULT also shows this as the winning GPO.

RSOP on my PC shows Audit Policy settings as Not Defined (some are enabled by default if not defined).

I had a look through our Group Policy and can't see why this is happening.  Does anyone have any ideas?

thanks

j

Active Directory
windows server

1 Reply

  • justletmelogin50's avatar
    justletmelogin50
    Brass Contributor
    Apr 02, 2025

    Resolved!  An advanced audit option had been set the removed, but that basically disables the other auditing options.  I found a process online for reverting back and all good.