Solved

How can I run an audit on Active directory admin users to see what they have changed.

Posted on 2008-10-27
5
207 Views
Last Modified: 2012-05-05
We have to give admin permissions in Active Directory for people to do user admin tasks like change passwords etc. A particular user who had this role gave himslf rights to open the MD's mailbox in exchange. Is there anyway we can lock this down or even better give them access but audit if they change anything in AD for example give himself access to someones mailbox.

Cheers Guys glad for any help on this
0
Comment
Question by:HBPROCK
  • 2
  • 2
5 Comments
 
LVL 70

Accepted Solution

by:
KCTS earned 125 total points
ID: 22811214
You need to aduit account management and privilaged use for the users see
http://technet.microsoft.com/en-us/library/cc737542.aspx
0
 
LVL 58

Expert Comment

by:tigermatt
ID: 22811288

Why are you giving users Domain Admins access just to perform simple tasks such as Reset Passwords, Unlock User Accounts etc.? This completely defies the rule of 'only give just as many permissions as required' - having users as complete Domain Admins when it isn't required is just a major security risk.

I suggest you remove these Domain Admin privileges from users, and add all the users who need the elevated privileges to a Security group. You can then Delegate Control over particular OUs to that security group - so you can delegate the rights to reset a password without the need for users to be a major security risk to your company network. See http://www.windowsecurity.com/articles/Built-in-Groups-Delegation.html.

And as for auditing what has already been done, you can use the approach KCTS has posted, but remember you CANNOT enable this and expect to see audit logs from before it was enabled. You can only see the audited logs from the moment of enabling this feature.

-tigermatt
0
 

Author Comment

by:HBPROCK
ID: 23013572
Hi guys thanks for you replys I have turned this on and there already seems to be loads of security logs flying around in event viewer especialy logon logoff etc. I can now see if an admin goes in and resets a password but doesn't seem to show anything if they goint a user and give themselves access to there mailbox. Also is this the only way of logging as it seems that you have to keep an eye on it all the time is there no way it can just email you when a certain event occurs?

Thanks
0
 
LVL 58

Assisted Solution

by:tigermatt
tigermatt earned 125 total points
ID: 23014471

Natively, Windows uses the Security event log to log audited events - that is what that event log exists for in the first place. There's no native method by which you can set yourself to be emailed if something happens, and it is expected for lots of events to be flying around as a result of auditing. You need to be very careful precisely what you audit - and only audit just enough - to ensure you do not fill the event logs too quickly and cause a detriment to the server performance.

-tigermatt
0
 

Author Closing Comment

by:HBPROCK
ID: 31510240
Ok guys thanks for your help!
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

[b]Ok so now I will show you how to add a user name to the description at login. [/b] First connect to your DC (Domain Controller / Active Directory Server) SET PERMISSIONS FOR SCRIPT TO UPDATE COMPUTER DESCRIPTION TO USERNAME 1. Open Active …
Mapping Drives using Group policy preferences Are you still using old scripts to map your network drives if so this article will show you how to get away for old scripts and move toward Group Policy Preference for mapping them. First things f…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question