myhelpermonkey
asked on
AD Auditing
Is there a way (possibly with PowerShell) to audit changes made on certain high privilege groups (ie domain admins) and send out an email when a user is added? I know these events are logged on the DC, but we want to be more proactive on monitoring these changes.
I know it might not help but we use something called AD Audit and Ad Manager internally which we think works perfectly. Not only does it tell us when someone is added or removed from the Domain Admin groups but it also gives you information like who deleted an AD account, who disabled/enabled an AD account, who's created and account and the biggest one to us any changes to any Service accounts. Bear in mind this tool has also helped us solve AD account which have continuously locked out for being left logged in on a machine or on a phone using rogue credentials. I would highly advise the use of the above 2 tools.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
What event ID's should we be monitoring to get alerted for group changes? I would also want to limit the alerts to just critical AD groups so we are not flooded with emails. Is that possible to do based on the first suggestion that was offered?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
http://blogs.technet.com/b/jhoward/archive/2010/06/16/getting-event-log-contents-by-email-on-an-event-log-trigger.aspx