4768 event not logged after windows update of... Expand / Collapse
Author
Message
Posted 3/22/2017 1:08:54 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 3/28/2017 10:04:30 AM
Posts: 6, Visits: 3
Hi Team,

The event 4768 not logged in windows security log,after applying windows update of KB4012216,KB4012213 on windows server 2012 r2 domain controller.
Post #7340
Posted 3/26/2017 3:08:11 PM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 237, Visits: 0
Please ensure that the correct audit categories are enabled. You will need Account Logon -> Kerberos Authentication Service success and failure enabled.
Post #7346
Posted 3/27/2017 10:57:18 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 3/28/2017 10:04:30 AM
Posts: 6, Visits: 3
Hi Derek,

Thanks for your answer.

The audit policies are configured properly.The event(4768) getting logged after a workaround of disabling advanced audit policies and enabling legacy audit polices.

Also lot of users facing this problem after windows update
https://www.reddit.com/r/sysadmin/comments/5zs0nc/heads_up_ms_kb4012213_andor_ms_kb4012216_disables/?st=j0kh8ocn&sh=9fc2f9c1
Post #7349
Posted 4/11/2017 1:30:23 PM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 237, Visits: 0
Thanks for the info. This sounds like a good ticket for MS or a workaround until it gets fixed.
Post #7355
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 11:02pm