Microsoft announced emergency patches to resolve a significant display issue with local audit logon policies in Active Directory Group Policy affecting several Windows versions. The problem leads to confusion as logon/logoff events may register correctly despite the policy appearing disabled. These out-of-band updates, applicable to Windows 11 and various Windows Server editions, were made available to help administrators properly track auditing events critical for security and compliance. Organizations must manually install these patches if affected, as they are not classified as security updates.
"We have identified an issue where audit logon/logoff events in the local policy of Active Directory Group Policy may not appear as enabled, even if they are enabled and expected to work."
"The 'Audit logon events' policy setting is an important function for system administrators. When it is enabled, they can keep track of logon and logoff events and generate new entries in the audit logs."
Collection
[
|
...
]