Group Policy Guardian did not pick up a GPO deletion in a Windows 2000 domain. (NETIQKB47683)

  • 7747683
  • 02-Feb-2007
  • 15-Mar-2013

Environment

NetIQ Group Policy Guardian 2.0

Resolution

fact
NetIQ Group Policy Guardian 2.0

symptom

Group Policy Guardian did not pick up a GPO deletion in a Windows 2000 domain.



symptom
GPO delete operations are not being reported by Group Policy Guardian.

symptom

When a GPO is deleted, the GPG server contains the following event in the application log: 

Event Type: Warning
Event Source: GPG Auditing
Event Category: Audit Engine
Event ID: 7777
Date: 6/10/2005
Time: 10:34:33 AM
User: N/A
Computer: Computername
Description:
FAZAM Auditing Failed. Detail: Exception handled in CaptureObjectdata. ThreadID: 8d4 and Error Location: 1000



cause
This occurs because Windows 2000 Service Pack 3 and 4 security event displays the operation as a delete operation and not as a delete child operation.

fix

This issue is addressed in Group Policy Guardian Version 2.0 Hotfix 47683.

This hotfix addresses the issue where NetIQ Group Policy Guardian (GPG) fails to generate an event for a GPO deletion on a Windows 2000 domain controller.  If you delete a GPO on a Windows 2000 domain controller and GPG does not generate an event, install this hotfix.

To download and install this hotfix:

This hotfix modifies the following files in the GPG Server installation folder. By default, this folder is \Program Files\NetIQ\Group Policy Guardian.

  • bin\EventAudit.exe

For more information, contact Technical Support at www.netiq.com/support.



Additional Information

Formerly known as NETIQKB47683