AD Auditing

Is there a way (possibly with PowerShell) to audit changes made on certain high privilege groups (ie domain admins) and send out an email when a user is added?  I know these events are logged on the DC, but we want to be more proactive on monitoring these changes.
myhelpermonkeyAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

David Johnson, CD, MVPOwnerCommented:
in the dc's event logs find the event id and then you can select send an email on event.
http://blogs.technet.com/b/jhoward/archive/2010/06/16/getting-event-log-contents-by-email-on-an-event-log-trigger.aspx
0
RizzleCommented:
I know it might not help but we use something called AD Audit and Ad Manager internally which we think works perfectly. Not only does it tell us when someone is added or removed from the Domain Admin groups but it also gives you information like who deleted an AD account, who disabled/enabled an AD account, who's created and account and the biggest one to us any changes to any Service accounts. Bear in mind this tool has also helped us solve AD account which have continuously locked out for being left logged in on a machine or on a phone using rogue credentials. I would highly advise the use of the above 2 tools.
0
David Johnson, CD, MVPOwnerCommented:
0
myhelpermonkeyAuthor Commented:
What event ID's should we be monitoring to get alerted for group changes? I would also want to limit the alerts to just critical AD groups so we are not flooded with emails.  Is that possible to do based on the first suggestion that was offered?
0
LearnctxEngineerCommented:
I use Splunk (log retention and alerting) and SCOM (alerting). Right now I log around 200GB of AD logs a day into Splunk. Splunk allow you to log 500MB/day for free which is achievable if you filter the logs to only include group change events.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.