Journalisation d’événements non sollicitée : identification des configurations d’audit natives dans un nouveau déploiement AWS sous Windows Server 2019

Hi Camille Richard,

The activity you are seeing is the intended behavior for modern Windows Server environments. Starting with Windows Server 2016 and continuing through 2019 and 2022, Microsoft implemented a "secure by default" posture that enables several Advanced Audit Policy subcategories immediately upon installation. Even before you link a single GPO, the operating system kernel is hardcoded to capture "Success" events for critical activities. This includes process creation, which generates Event ID 4688, and account logons, which generate Event ID 4624. These events allow for immediate forensic visibility without requiring manual administrative setup.

When you promoted these EC2 instances to Domain Controllers, the "Default Domain Controllers Policy" was automatically applied. This policy is unique because it specifically targets the OU containing your DCs and enforces more rigorous auditing for directory service access and account management. If you observe logs involving the Security Accounts Manager or Kerberos authentication, these are triggered by this built-in GPO. To see exactly which rules are currently in effect and bypassing the "Not Configured" labels often seen in the local security policy UI, you should run auditpol /get /category:* from an administrative command prompt. This utility queries the system's effective policy directly from the local security authority, providing the most accurate view of your active audit state.

If this answer helped, please click "Accept Answer " so that other community members with similar issues can easily find the solution. Your contribution is much appreciated.

Domic V.

Bonjour Camille Richard,

Votre problème a-t-il déjà été résolu ? Si c'est le cas, merci d'accepter la réponse car cela aide aussi d'autres personnes partageant le même problème. Merci :)

Domic V.