Hello
I have a Server 2008 R2 64 Domain Controller, with Symantec Antivirus, File / Print.
I have a policy setup to audit success and failures; Group Policy, Computer Configuration, Windows Settings, Security Settings, Local Policies, Audit Policies, Success / Failure that works fine.
I have an additional requirement to add additional auditing to c:\windows\system32\winevt\logs 'security.evtx' with "Everyone" in auditing for FAILURE, which audits fine
I clear the logs weekly from Event Viewer, when I clear and save the Security log, the "Everyone" is removed fromc:\windows\system32\winevt\logs 'security.evtx' and I have to manually put it back in.
Any ideas what is causing this?
Thank you
bruce