Microsoft releases out-of-band updates to fix reporting error

“The issue is that the setting to audit logon and logoff events may be disabled (set to ‘no auditing’) and yet still produce log entries for events of this type,” explained Fred Chagnon, principal research director at Info-Tech Research Group. “These events are triggered by users or devices authenticating to the local Active Directory when joining the domain.”

Potentially confusing reports

Out-of-band updates address urgent issues outside of regular release cycles, often for security or other critical issues. They require manual download and installation because they do not impact all users.

The AD Group Policy inconsistency is visible in the Local Group Policy Editor (where administrators manage policy settings on a local computer) and Local Security Policy (where administrators manage security settings on individual computers). The ‘audit logon events’ policy setting allows system administrators to track logon and logoff events and create new entries in audit logs that register all user and service activities. It is typically used in security and compliance scenarios.