• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 272
  • Last Modified:

Securing Group Policy from unauthorized changes

Good afternoon everyone,

I work in a mid size company where there are two of us that have full domain administrative rights.  My counterpart as he is refered to has no experience with network administration, no training, no certifications and likes to just jump in and see what happens by changing settings.

THe problem is I am tired of trying to figure out what has been changed, why and why wasn't I told.  And, like most situations with rogue admins they claim the ole 'I didn't change anything!'.

So what I need to find is a way to lock this person out of the group policy settings and or to have a log or notification that a policy has been modified.  Is there an easy way to do this without buying hardware or software?

1 Solution
Mike KlineCommented:
You can enable auditing and then use event triggers to send you notifications

event 566 in 2003 It is 566 for 2003, see this question I helped with   http://www.experts-exchange.com/Software/Server_Software/File_Servers/Active_Directory/Q_24534479.html

corresponding to 566 in 2008   http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=566

More on forwarding the event here  http://portal.sivarajan.com/2010/04/generate-email-alert-to-event-attach.html

The ultimate answer is to train him up or take away admin rights.


SandeshdubeySenior Server EngineerCommented:
As you have mentioned that you both are having admin rights and if you both are using the same admin userid then create seperate domain admin id account for each  and configure audit Active Diretory object to keep track of users which are given rights to perform certain activities on AD.
Reference KB article:http://support.microsoft.com/kb/814595

Event id 566 will be logged if GP is change see sample log in the link provide below.

Note:Active Directory audit logs can show you who made changes to what object attributes if it si not enabled the events will not be logged.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now