Verify Auditing of Logon Events on Domain Controllers
The AD integration with domain controllers requires each domain controller to audit logon events.
On each domain controller (excluding read-only domain controllers), enable the Audit account logon events to include Success and Failure if it is set to No Auditing.
By default, this group policy is set to log Success logon events and you should not modify it. Secure Access requires the Audit account logon events setting so that it knows whether a user has logged in successfully and can then compare that logon to subsequent events generated by that user.
If the Audit Policy is not set, the Windows Configuration Script for Domain Controller displays this error message:
"ERROR: "
-----------------------------------------------------------------------------
Your Group Policy for this Domain Controller is set to NOT audit successful logon events!
You MUST edit the following Group Policy for all DCs:
Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Audit Policy\Audit logon events
Define that policy to audit Success attempts, gpupdate, and re-run this script!