Home

Window server 2012 R2 audit SAM log issue

ⓛ ⓤⓝ W
Frequent Visitor

Hi all,

I have a question about the audit log 4661.

I am using advanced audit logging. Enabled audit SAM and audit kernel object which generate event id 4661.

Now I have 2 2012 R2 DC, one is setup without any window update. Another one installed all recommend and important update.

The situation is, when a domain user logged off.

DC without update can generate event id 4661.

DC with updates will not generate event id 4661 but event 4768,4769.

 

What can I do to make the DC with updates generate 4661 when a user is logged off?

 

 

 

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
35 Replies
Extentions Synchronization
ChirmyRam in Discussions on
3 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies