Solved

AD Auditing

Posted on 2014-10-09
6
109 Views
Last Modified: 2014-11-20
Is there a way (possibly with PowerShell) to audit changes made on certain high privilege groups (ie domain admins) and send out an email when a user is added?  I know these events are logged on the DC, but we want to be more proactive on monitoring these changes.
0
Comment
Question by:myhelpermonkey
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
6 Comments
 
LVL 80

Expert Comment

by:David Johnson, CD, MVP
ID: 40371606
in the dc's event logs find the event id and then you can select send an email on event.
http://blogs.technet.com/b/jhoward/archive/2010/06/16/getting-event-log-contents-by-email-on-an-event-log-trigger.aspx
0
 
LVL 13

Expert Comment

by:Rizzle
ID: 40371608
I know it might not help but we use something called AD Audit and Ad Manager internally which we think works perfectly. Not only does it tell us when someone is added or removed from the Domain Admin groups but it also gives you information like who deleted an AD account, who disabled/enabled an AD account, who's created and account and the biggest one to us any changes to any Service accounts. Bear in mind this tool has also helped us solve AD account which have continuously locked out for being left logged in on a machine or on a phone using rogue credentials. I would highly advise the use of the above 2 tools.
0
 
LVL 80

Assisted Solution

by:David Johnson, CD, MVP
David Johnson, CD, MVP earned 250 total points
ID: 40372290
0
 

Author Comment

by:myhelpermonkey
ID: 40373528
What event ID's should we be monitoring to get alerted for group changes? I would also want to limit the alerts to just critical AD groups so we are not flooded with emails.  Is that possible to do based on the first suggestion that was offered?
0
 
LVL 17

Accepted Solution

by:
Learnctx earned 250 total points
ID: 40374210
I use Splunk (log retention and alerting) and SCOM (alerting). Right now I log around 200GB of AD logs a day into Splunk. Splunk allow you to log 500MB/day for free which is achievable if you filter the logs to only include group change events.
0

Featured Post

Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Disable network adapter without DHCP IP address 1 23
SQL Job running powershell script 2 33
MFA in Azure for a hybrid org 2 45
User Account issue 6 44
The Nano Server Image Builder helps you create a custom Nano Server image and bootable USB media with the aid of a graphical interface. Based on the inputs you provide, it generates images for deployment and creates reusable PowerShell scripts that …
A project that enables an administrator to perform actions within a user session context not just at the time of login but any time later on day(s) or week(s) later.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…

696 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question