We help IT Professionals succeed at work.

Check out our new AWS podcast with Certified Expert, Phil Phillips! Listen to "How to Execute a Seamless AWS Migration" on EE or on your favorite podcast platform. Listen Now

x

How do I set up monitoring on domain admin accounts

Medium Priority
781 Views
Last Modified: 2013-12-04
Part of our security audit asks how we monitor all domain admin account activites and i wondered if there was a way to set this up for all admin accounts on a blanket monitoring basis for everything we do under our domain accounts

It would make life alot easier and and satisfy auditors
Many thanks
Comment
Watch Question

Commented:
Unlock this solution with a free trial preview.
(No credit card required)
Get Preview
Adam BrownSenior Systems Admin
CERTIFIED EXPERT
Top Expert 2010

Commented:
In order to collect events, you need to enable auditing for Directory Service Access. http://technet.microsoft.com/en-us/library/cc771395(WS.10).aspx has a lot of information on configuring Auditing, and it's a fairly sizable subject. Generally, you can configure windows to collect information on changes that are made (and by whom) fairly easily, and changes to anything on the domain would be logged. The problem is that it isn't presented in a very efficient or understandable manner. That's where third party tools like the one linked by vak73 come in. Those can collect the events that are written to the audit log in Windows and collate them into a more readable format.

Commented:
How to use Group Policy to configure detailed security auditing settings for Windows Vista-based and Windows Server 2008-based computers in a Windows Server 2008 domain, in a Windows Server 2003 domain, or in a Windows 2000 domain. -> http://support.microsoft.com/kb/921469

Run this on your DC to enable auditing for user management for instance:

auditpol /set /subcategory:"user account management" /success:enable /failure:enable

Then you can create a custom view in event viewer to show account management events.

Author

Commented:
costly solution but does the job
Unlock the solution to this question.
Thanks for using Experts Exchange.

Please provide your email to receive a free trial preview!

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.