Kind of a weird problem, joined a Windows 2008 R2 server to the domain, at no point though does it appear to have logged the default security events except the most basic ones relating to start up and shut down. E.g. Event ID 4624 is not recorded for local log on events.
There is a domain security policy which overrides some of the local settings, but at no point even before joining the domain did it appear to record local log on events and nearly all the other default stuff it's supposed to record.
So I went into the local security policy on the server and forced the auditing to occur, this has solved the problem but I'm a bit worried as to why it happened in the first place? Some weird problem with the setup of the server? Is there anything I can check in the registry for example to see what may have happened?