Environment
Resolution
NetIQ Group Policy Guardian 2.0
symptom
Group Policy Guardian did not pick up a GPO deletion in a Windows 2000 domain.
symptom
GPO delete operations are not being reported by Group Policy Guardian.
symptom
When a GPO is deleted, the GPG server contains the following event in the application log:
Event Type: Warning
Event Source: GPG Auditing
Event Category: Audit Engine
Event ID: 7777
Date: 6/10/2005
Time: 10:34:33 AM
User: N/A
Computer: Computername
Description:
FAZAM Auditing Failed. Detail: Exception handled in CaptureObjectdata. ThreadID: 8d4 and Error Location: 1000
cause
This occurs because Windows 2000 Service Pack 3 and 4 security event displays the operation as a delete operation and not as a delete child operation.
fix
This issue is addressed in Group Policy Guardian Version 2.0 Hotfix 47683.
This hotfix addresses the issue where NetIQ Group Policy Guardian (GPG) fails to generate an event for a GPO deletion on a Windows 2000 domain controller. If you delete a GPO on a Windows 2000 domain controller and GPG does not generate an event, install this hotfix.
To download and install this hotfix:
- Run the GPG20000_Hotfix47683.exe file on computers with a GPG Server.
This hotfix modifies the following files in the GPG Server installation folder. By default, this folder is \Program Files\NetIQ\Group Policy Guardian.
- bin\EventAudit.exe
For more information, contact Technical Support at www.netiq.com/support.