NetIQ Group Policy Guardian 2.0
Group Policy Guardian did not pick up a GPO deletion in a Windows 2000 domain.
GPO delete operations are not being reported by Group Policy Guardian.
When a GPO is deleted, the GPG server contains the following event in the application log:
Event Type: Warning
Event Source: GPG Auditing
Event Category: Audit Engine
Event ID: 7777
Time: 10:34:33 AM
FAZAM Auditing Failed. Detail: Exception handled in CaptureObjectdata. ThreadID: 8d4 and Error Location: 1000
This occurs because Windows 2000 Service Pack 3 and 4 security event displays the operation as a delete operation and not as a delete child operation.
This issue is addressed in Group Policy Guardian Version 2.0 Hotfix 47683.
This hotfix addresses the issue where NetIQ Group Policy Guardian (GPG) fails to generate an event for a GPO deletion on a Windows 2000 domain controller. If you delete a GPO on a Windows 2000 domain controller and GPG does not generate an event, install this hotfix.
To download and install this hotfix:
- Run the GPG20000_Hotfix47683.exe file on computers with a GPG Server.
This hotfix modifies the following files in the GPG Server installation folder. By default, this folder is \Program Files\NetIQ\Group Policy Guardian.
For more information, contact Technical Support at www.netiq.com/support.