0

I have two computers inside an Active Directory domain (one of which is the secondary Domain Controller) which stopped logging Security events last March and April respectively.

Other Event Logs (Application, System) are up to date. I can generate Application events through command line and they show, I don't know how to generate Security events other than logging on and off, opening applications as Administrator. If I restart, stop or start the "Windows Event Log" service I can see the corresponding event in the Security Event Log but nothing else.

I already cleared the log, deleted the log file, restarted the services connected to lsass.exe with the exception of "Security Accounts Manager" which doesn't give me the option to. I assumed lsass.exe isn't working because as far as I understand it's the process in charge of writing to the Security Event Log.

From the task manager I right-clicked lsass.exe and "Analyze wait chain". It told me that lsass.exe was waiting on another process, ismserv.exe

I restarted its service "Intersite Messaging" but that solved nothing either.

I can't restart these machines yet, not until I get authorization (that is if I get it), I don't know how else to debug this problem.

4
  • 1
    Is the group policy set to enable logging? Audit Active Directory objects in Windows Server 2003. Sep 24, 2021 at 16:28
  • I don't know, that's where I wanted to check next. But aren't policies the same for all computers in the domain? Assuming that those two machines are getting the policies like everyone else
    – mfloris
    Sep 24, 2021 at 17:02
  • "aren't policies the same for all computers in the domain" - no, as far as I know—which is not much when it comes to domains or group policy. You should be able to find out how to find out what the current policy is on a particular machine. Sep 24, 2021 at 18:34
  • You can run rsop.msc to see the resultant set of policies. Sep 24, 2021 at 21:00

1 Answer 1

0

I solved through secpol.msc

  • Advanced Audit Policy Configuration
    • Account Logon
    • Logon/Logoff

I double clicked the subcategories of interest in the right pane (such as Audit Logon, Audit Logoff, Audit Credential Validation) and even though they were already configured to "Success and Failure" I disabled them, clicked Apply, re-enabled them, Apply.

Somehow this unlocked the two machines. I don't know how permanent this fix is it but it did survive a reboot and a gpupdate /force (that returned success).

It should be noted though that there are WSUS and conflicting policies problems in the domain. All computers return error 0x8024002e in their Update Status.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.