Advanced Audit Policy not getting applied on 2012 R2

[ForumBot]

I have configured several avanced audit policy settings under:

```
Computer Configuration => Policies => Windows Settings => Security Settings =>
Advanced Audit policy Configuration => Audit Policies => ...

```

Also the following setting is set to "Enabled":

```
Computer Configuration => Policies => Windows Settings => Security Settings =>
Local Policies => Security Options => Audit: Force audit policy subcategory settings
(Windows Vista or later) to override audit policy category settings.

```

However none of the advanced audit settings is getting applied. Running

```
auditpol /get /category:*

```

shows all options set to "No Auditing". Also there are none of the deprecated audit policies set.

What surprises me, is that neither **gpresult** nor **rsop.msc** show up the "Advanced audit policy" category. What am I doing wrong here? I am running out of ideas. Thanks in advance for your input!

**[1. Addendum]**

-

Other settings configured in the same group-policy object are getting applied. So the common pitfalls can be ruled out.

-

The originally GPO contains MSS settings

-

Creating a new, empty GPO and only setting the advanced audit configuration items, make them appear on the target server (checked with auditpol). So there must be something wrong with the GPO itself.

**[2. Addendum]**

- Comparing both {GUID}\Machine\Microsoft\Windows NT\Audit\Audit.csv files with each other reveals the following difference. Note the double occurence of "audit".

**Non working version of audit.csv:**

```
,System,Audit Policy Change,{0CCE922F-69AE-11D9-BED3-505054503030},Success and Failure,,3

```

**Working version of audit.csv:**

```
,System,Audit Audit Policy Change,{0cce922f-69ae-11d9-bed3-505054503030},Success and Failure,,3

```

Whats going on here? Any compelling reasons to not edit this file manually?

[ForumBot]

I realize this is an older question, and that you resolved the issue a different way, however, the reason it wasn't working originally was due to "Audit: Force audit policy subcategory settings" being enabled. As explained in [this article on Technet](http://blogs.technet.com/b/askds/archive/2011/03/11/getting-the-effective-audit-policy-in-windows-7-and-2008-r2.aspx):

>


The lack of Object Access auditing is expected: as soon as you start
applying Advanced Audit Configuration Policy, legacy policies will be
completely ignored. The only way to get a Win7/R2 computer to start
using legacy policy is to set the security policy “Audit: Force audit
policy subcategory settings (Windows Vista or later) to override audit
policy category settings” to DISABLED. That disables the use of the
newer policy type. Then you must clear the existing advanced policy
from the machines (auditpol.pol /clear, having a blank audit.csv file,
etc). The system isn't optimal, but the intention was never for you to
go back.