Scribd
Upload
32 views

Active Directory Auditing Quick Reference Guide PDF

This document provides instructions for enabling auditing of changes in Active Directory. It outlines how to configure audit policy settings through Group Policy to log account management, directory service access, logon events. It also describes how to enable object-level auditing on the domain to track changes to objects and permissions. Finally, it lists important event IDs to search in the security log and recommends settings for the security log size and retention.

Uploaded by

nicolepetrescu
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
32 views

Active Directory Auditing Quick Reference Guide PDF

This document provides instructions for enabling auditing of changes in Active Directory. It outlines how to configure audit policy settings through Group Policy to log account management, directory service access, logon events. It also describes how to enable object-level auditing on the domain to track changes to objects and permissions. Finally, it lists important event IDs to search in the security log and recommends settings for the security log size and retention.

Uploaded by

nicolepetrescu
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 1

Quick Reference Guide

Active Directory Auditing


This quick reference guide shows how to enable logging of important changes in your
Active Directory and view them via Event Viewer.

Audit Policy Settings

Run GPMC.msc (url2open.com/gpmc) > create a new policy and link


this GPO to an organizational unit (OU) that contains the domain in
which youd like to track changes. Once the GPO is created you must
go into Computer Configuration > Policies > Windows Settings >
Security Settings > Local Policies > Audit Policy:
Audit account management > Define > Success
Audit directory service access > Define > Success
Audit account logon events > Define > Success and Failure
Audit logon events > Define > Success and Failure

Object-level Active Directory Auditing

Open ADSI Edit (url2open.com/adsi) > Connect to Default naming


context > Right-click DomainDNS object with the name of your domain
> Properties > Security (Tab) > Advanced (Button) > Auditing (Tab):
Add Principal Everyone
Type Success
Applies to This object and Descendant objects
Permissions > Select all check boxes except the following: Full Control,
List Contents, Read all properties, Read permissions > Click OK

Event ID Reference

1102 Security log cleared

4624 Login succeeded

4625, 4771 Failed login

4625, 4771 (Failure code 0x17)


Password expired

4720 User account created

4722 User account enabled

4724 Password reset attempt

4725 User account disabled

4726 User account deleted

4727, 4731, 4754 , 4759, 4744, 4749


Group created

Member added to a group

4729, 4733, 4757, 4762, 4747, 4752


Member removed from a group

Security Event Log Settings

4728, 4732, 4756 , 4761, 4746, 4751

Run GPMC.msc
> open Default Domain Policy > Computer
Configuration > Policies > Windows Settings > Security Settings > Event
Log > Define
Maximum security log size to 4GB
Retention method for security log to Overwrite events as needed
Open Event viewer and search Security log for event ids listed in the
Event ID Reference box

4730, 4734, 4758, 4748, 4753, 4763


Group deleted

4740 User account locked out

4743 Computer deleted

4764 Group type changed

4767 User account unlocked

Gain #completevisibility into what's happening in your Active Directory


environment with Netwrix Auditor for Active Directory:
netwrix.com/go/trial-ad
Corporate Headquarters:
300 Spectrum Center Drive, Suite 1100,
Irvine, CA 92618

Toll-free: 888-638-9749

Int'l: 1-949-407-5125
EMEA: 44 (0) 203-318-0261

netwrix.com/social

You might also like