With object auditing and directory audit settings correctly applied, all necessary file system access events are logged to the
Security event log. When making changes locally (to
C:\Share for example), the event logs are generated perfectly. However, when making changes through a share from a remote machine (
C:\Share exposed via
\\Server\Share for example), a log entry is created, but all expected values, such as
Security ID and
Account Name, have not been replaced correctly and only contain the placeholder fields
Entries with missing values like this are only created when making changes from another machine on the network. Tested with multiple users coming from multiple machines on the same network and domain all with the same result, nothing else is creating entries like this. Other machines with the same object audit policy and audit settings applied to the target directory work correctly, it only happens on just one rogue Windows 2012 server.
Has anyone ever seen this before? What could cause the placeholder fields not to be set?
It seems quite critical since a failure to create a security audit entry is a big deal, especially for remote file system access.