Solved

How can I run an audit on Active directory admin users to see what they have changed.

Posted on 2008-10-27
5
208 Views
Last Modified: 2012-05-05
We have to give admin permissions in Active Directory for people to do user admin tasks like change passwords etc. A particular user who had this role gave himslf rights to open the MD's mailbox in exchange. Is there anyway we can lock this down or even better give them access but audit if they change anything in AD for example give himself access to someones mailbox.

Cheers Guys glad for any help on this
0
Comment
Question by:HBPROCK
  • 2
  • 2
5 Comments
 
LVL 70

Accepted Solution

by:
KCTS earned 125 total points
ID: 22811214
You need to aduit account management and privilaged use for the users see
http://technet.microsoft.com/en-us/library/cc737542.aspx
0
 
LVL 58

Expert Comment

by:tigermatt
ID: 22811288

Why are you giving users Domain Admins access just to perform simple tasks such as Reset Passwords, Unlock User Accounts etc.? This completely defies the rule of 'only give just as many permissions as required' - having users as complete Domain Admins when it isn't required is just a major security risk.

I suggest you remove these Domain Admin privileges from users, and add all the users who need the elevated privileges to a Security group. You can then Delegate Control over particular OUs to that security group - so you can delegate the rights to reset a password without the need for users to be a major security risk to your company network. See http://www.windowsecurity.com/articles/Built-in-Groups-Delegation.html.

And as for auditing what has already been done, you can use the approach KCTS has posted, but remember you CANNOT enable this and expect to see audit logs from before it was enabled. You can only see the audited logs from the moment of enabling this feature.

-tigermatt
0
 

Author Comment

by:HBPROCK
ID: 23013572
Hi guys thanks for you replys I have turned this on and there already seems to be loads of security logs flying around in event viewer especialy logon logoff etc. I can now see if an admin goes in and resets a password but doesn't seem to show anything if they goint a user and give themselves access to there mailbox. Also is this the only way of logging as it seems that you have to keep an eye on it all the time is there no way it can just email you when a certain event occurs?

Thanks
0
 
LVL 58

Assisted Solution

by:tigermatt
tigermatt earned 125 total points
ID: 23014471

Natively, Windows uses the Security event log to log audited events - that is what that event log exists for in the first place. There's no native method by which you can set yourself to be emailed if something happens, and it is expected for lots of events to be flying around as a result of auditing. You need to be very careful precisely what you audit - and only audit just enough - to ensure you do not fill the event logs too quickly and cause a detriment to the server performance.

-tigermatt
0
 

Author Closing Comment

by:HBPROCK
ID: 31510240
Ok guys thanks for your help!
0

Featured Post

VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Last week, our Skyport webinar on “How to secure your Active Directory” (https://www.experts-exchange.com/videos/5810/Webinar-Is-Your-Active-Directory-as-Secure-as-You-Think.html?cid=Gene_Skyport) provided 218 attendees with a step-by-step guide for…
This article outlines the process to identify and resolve account lockout in an Active Directory environment.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question