Solved

Track Add/Remove on Local Administrators Group on Windows Servers

Posted on 2014-01-27
5
2,997 Views
Last Modified: 2016-01-25
Hello,

We constantly get complaints from application owners that certain domain account/groups are either added or removed from the Local Administrator groups on their servers.  Is there any way to capture an event like this in the event log?  If not, does anyone know of a tool in the community that can help with this issue?  Thanks.
0
Comment
Question by:Techop09
  • 2
  • 2
5 Comments
 
LVL 5

Accepted Solution

by:
RAdministrator earned 400 total points
ID: 39812731
0
 

Author Comment

by:Techop09
ID: 39813110
Thanks, but I'm not looking to audit AD groups.  I'm looking to audit the Local Administrators group on a particular server, or group of servers.  Any ideas on how to do that?
0
 
LVL 5

Expert Comment

by:RAdministrator
ID: 39813519
Not sure if this will help you out, as it is a static tool that just queries the local admins group, but you could write a script to run it once a day or so, and export group membership to a file.

http://www.cjwdev.co.uk/Software/GetLocalAdminsGUI/Info.html

Tested, does what it says.

P.S. If your server installation is in a language other than English, the local admins group may be named in the installation language (e.g. in French it's "Administrateurs") Make sure to change the default group name in the Options.
0
 

Expert Comment

by:vibhuti dhiman
ID: 41431569
Hi,
Is there a way to determine who made the change ? Like addition/removal to the local admin group of the server ? event IDS - 636,637 seem to audit active directory group changes not local group changes..
0
 

Expert Comment

by:vibhuti dhiman
ID: 41431582
Never mind , i got it , thanks ! Event Ids - 4732 and 4733
0

Featured Post

SharePoint Admin?

Enable Your Employees To Focus On The Core With Intuitive Onscreen Guidance That is With You At The Moment of Need.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
WIndows 2012 R2 Certificate Services 5 40
Blocking Microsoft Edge From Running? 14 60
windows cluster 2012/2014  cluster operation. 5 38
Shared files and folders migration 2 31
What to do when Windows Update is not working correctly? What tools can I use to detect the cause of the malfunction problem? What does this numeric error code mean? These and other questions that you have been asking in the past are answered here (…
The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question