The AA console is logging numerous events of the following type, and/or, sending alerts for these events:
The system audit policy was changed by ‘NT AUTHORITY\SYSTEM’ on [name of the domain controller]
No other information is given, including the nature of the change that was made.
Ensure the Base Filtering Service is enabled on the DCs reporting the events by right clicking on the Base Filtering Engine service and select Properties. Set the service to Automatic and start it.
© 2025 Quest Software Inc. ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center