I accidentally audited "logon events" instead of "account logon events" in the default domain policy and now it audits every system logon event and I cant switch it back. I set up domain auditing the way I want it and when I do a secedit /refreshpolicy machine_policy /enforce it tells me "Group policy propagation from the domain has been initiated for this computer.........." but it never refreshes. I've looked in the event log and there is no entry saying anything has changed. I've even waited 2 days for it to refresh itself and it never does. There is no auditing set for the local machine or the default domain controller policy. The only auditing defined is "audit account managment" and "audit directory service access". should I set these options on the default domain controller policy instead of the default domain policy? All I want to do is audit when specific groups log on or off of the domain, that why I checked the audit directory service access. Someone please help, this is really causing a painful headache

One more thing, when I look at the local machine audit policy of the server under local settings everything is set to no auditing. In the colum named "effective settings" audit logon events is set to success and failure, even though its set to no auditing under the default domain and domain controller policies.