What's a good tool for tracking what the windows domain administrator account is doing?

Hi,

We will have auditors coming into our office soon and I know they will ask me if I track what the domain administrator account is doing. We have three people using this user account to make changes as needed.

I'm looking for a tool that give us good idea what the windows domain administrator account is doing.

We've enabled auditing on our domain controllers and see a lot of entries being added now to this event log.

Is there a tool that summarizes this event log in reports or in drill down menus? Is the answer SCOM?

Thanks,

Dean
DeanUnitedAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

MightySWCommented:
Hi, have a look here to give you some ideas.  Looks like they were frustrated with scom as well.  You would have to setup the audits to pickup more than logins in you case of course.

http://mobile.experts-exchange.com/Q_24994402.html

HTH
0
DonNetwork AdministratorCommented:
0
MightySWCommented:
Quit swooping!!!!
0
Introducing the "443 Security Simplified" Podcast

This new podcast puts you inside the minds of leading white-hat hackers and security researchers. Hosts Marc Laliberte and Corey Nachreiner turn complex security concepts into easily understood and actionable insights on the latest cyber security headlines and trends.

DeanUnitedAuthor Commented:
Thanks dstewartjr, adaudit looks good for tracking login activity.
Mightysw - DumpSec looks dated. only mentions windoww 2000. any idea if it works with 2003 +.
 
Dean
0
DeanUnitedAuthor Commented:
sorry, I got the names backwards.
0
MightySWCommented:
Yes, AdAudit is a GREAT utility.  I have used it.  It has alot of features.  

Hyena is a good one too, but as you said, it could be a bit dated.  Most of them are unless you want to pay for some kind of central auditing program like GFI.

LOL, its ok on the names.  Me and the Stew are friends.

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
DonNetwork AdministratorCommented:
Hey mighty check into that for me. At lunch now
0
MightySWCommented:
Yes Dean, the link that DStew gave you for dumpsec WILL work for Win 2k3.  The reports are definitely the same as the event viewer format did not change from 2000 to 2003.

You should be good with either.  Both utilities will do what you need to do.  
0
DeanUnitedAuthor Commented:
Thanks guys,
I'm going to try these programs first before jumping into SCOM. I've heard from various sources that it's tough to figure out SCOM.
I understand Quest programs are good for monitoring changes in AD and file systems, but what about if I just want to monitor who is viewing HR directory? Any program for that?
0
MightySWCommented:
again, you are just looking at auditing and using dumpsec or ADaudit (free) to enumerate the billions of entries that you will get in the event log after you turn on file access auditing on that directory.  

Either utilities are easy to use once you get use to them.  You just dump them to a delimited text file and then open it up with excel where you can then filter.  Or you can just use the utilities to determine usage.  Both have good filters on them and sort ability.
0
DeanUnitedAuthor Commented:
Thanks guys,
 
ADAudit is working out great!
 
Dean
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Project Management

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.