Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings. Windows ...

Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings.

Windows Vista and later versions of Windows allow audit policy to be managed in a more precise way using audit policy subcategories.  Setting audit policy at the category level will override the new subcategory audit policy feature.  Group Policy only allows audit policy to be set at the category level, and existing group policy may override the subcategory settings of new machines as they are joined to the domain or upgraded to Windows Vista or later versions.  To allow audit policy to be managed using subcategories without requiring a change to Group Policy, there is a new registry value in Windows Vista and later versions, SCENoApplyLegacyAuditPolicy, which prevents the application of category-level audit policy from Group Policy and from the Local Security Policy administrative tool.

If the category level audit policy set here is not consistent with the events that are currently being generated, the cause might be that this registry key is set.

Default: Enabled

Audit Security Object changed: Primary User Name: %1 Primary Domain: %2 Primary Logon ID: %3 Client User Name: %4 Client ... Audit system events This security setting determines whether the OS audits any of the following events: Attempted system ... Audit: Audit the access of global system objects This security setting determines whether to audit the access of global system ... Audit: Audit the use of Backup and Restore privilege This security setting determines whether to audit the use of all user ... Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings. Windows ... Audit: Shut down system immediately if unable to log security audits This security setting determines whether the system ... Auditing settings on object changed: Object Server: %1 Object Type: %2 Object Name: %3 Handle ID: %4 Process ID: %5 Image ... Auditing settings on object were changed. Subject: Security ID: %1 Account Name: %2 Account Domain: %3 Logon ID: %4 Object: ... Auditing settings on object were changed. Subject: Security ID: %1 Account Name: %2 Account Domain: %3 Logon ID: %4 Object: ...