Long story short, how do I set my audit policies back to default?
I've found that somehow there's no auditing on a couple of my servers. I read that you can reset them to the OOB defaults with "auditpol /restore" but I get an error.
The help file indicates this is how you restore them from a backup, so I suspect the 0x00000002 error is basically a "file not found" error.
I went looking though, and when I do a
auditpol /get /category:* it shows "No Auditing" for EVERYTHING.
That's on all the servers in my domain. I KNOW my GPO doesn't specify this, and what's more, there are event logs... just not enough for me to track down where some account lockouts are coming from.
Actually, my GPO specifies that all failures are logged, and I have success turned off in a number of places. The event logs overwrite as needed, up to 16MB. I do have some...