Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium


domain admin audit

Posted on 2007-10-04
Medium Priority
Last Modified: 2011-10-03
A domain admin has been adding user accounts to the domain admins group.

How can I tell in the event logs which of my domain admins added these accounts to the group since none of them will own up.

Question by:58872
1 Comment
LVL 70

Accepted Solution

KCTS earned 2000 total points
ID: 20013171
If each of the domain admins has a unique ID and you have auditing of account management is enabled then it will be recorded in the security log - see http://www.windowsecurity.com/articles/Auditing-Users-Groups-Windows-Security-Log.html

However - being domain admins they may have cleared the security log (though that action itself should also be audited)

Featured Post

Become an Android App Developer

Ready to kick start your career in 2018? Learn how to build an Android app in January’s Course of the Month and open the door to new opportunities.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In the absence of a fully-fledged GPO Management product like AGPM, the script in this article will provide you with a simple way to watch the domain (or a select OU) for GPOs changes and automatically take backups when policies are added, removed o…
A bad practice commonly found during an account life cycle is to set its password to an initial, insecure password. The Password Reset Tool was developed to make the password reset process easier and more secure.
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.

581 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question