Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to implement change control and auditing in a Microsoft Windows network environment. My question is in methods to audit or better yet changes made to the networking environment. This starts with all Active Directory changes. I would also like to extend this out to network equipment (e.g. firewalls, routers, switches), and servers.

Having the automated audit of changes in the network will allow us to verify submitted change controls and accuracy of those changes.

Do you have suggestions on software which excels in this area?

share|improve this question
add comment

2 Answers

For the Active Directory part, there is a feature/aspect that you may want to be aware of.

Windows 2008 introduced the ability to audit creation, deletion, moves, and modification of objects. The information includes who performed the auditable event, and the DN of the object. In the case of modifications, two events are recorded, which essentially provides you with the current and previous values.

This is enabled on a DC with the following command:

auditpol /set /subcategory:"directory service changes" /success:enable  

You also need to enable success auditing in AD Users & Computers, typically at the domain level.

When you combine this with event log forwarding, the result is a very powerful and convenient capability. For example, we configure our dc's to forward event id's 5136-5139,5141 to the "Forwarded Events" event log on a central utility server.

A simple pull subscription from the collection server to the DC's in highly selective XPath query to filter noise can easily bring what you need to a single location, where it can be archived, reported on, or imported into another reporting system. Here is an example of such as query:

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">*[System[( (EventID &gt;= 5136 and EventID &lt;= 5139)  or EventID=5141) and TimeCreated[timediff(@SystemTime) &lt;= 3600000]]]</Select>
    <Suppress Path="Security">*[EventData[Data="S-1-5-18"]]</Suppress>
    <Suppress Path="Security">*[EventData[Data[@Name="AttributeLDAPDisplayName"] = "dNSTombstoned"]]</Suppress>
    <Suppress Path="Security">*[EventData[Data[@Name="AttributeLDAPDisplayName"] = "dnsRecord"]]</Suppress>
    <Suppress Path="Security">*[EventData[Data[@Name="AttributeLDAPDisplayName"] = "msExchExpansionServerName"]]</Suppress>
    <Suppress Path="Security">*[EventData[Data[@Name="AttributeLDAPDisplayName"] = "msExchServer1HighestUSNVector"]]</Suppress>
    <Suppress Path="Security">*[EventData[Data[@Name="AttributeLDAPDisplayName"] = "msExchMessageJournalRecipient"]]</Suppress>
    <Suppress Path="Security">*[EventData[Data[@Name="objectClass"] = "dnsNode"]]</Suppress>
    <Suppress Path="Security">*[EventData[Data[@Name="objectClass"] = "printQueue"]]</Suppress>
    <Suppress Path="Security">*[EventData[Data[@Name="objectClass"] = "serviceConnectionPoint"]]</Suppress>
    <Suppress Path="Security">*[EventData[Data[@Name="objectClass"] = "msExchAddressListService"]]</Suppress>
  </Query>
</QueryList>

There are some things that need to be configured for subscriptions to work properly. Some can be done in a group policy.

More information:

AD DS Auditing Step-by-Step Guide
http://technet.microsoft.com/en-us/library/cc731607%28WS.10%29.aspx

Configure Computers to Forward and Collect Events
http://technet.microsoft.com/en-us/library/cc748890.aspx

Quick and Dirty Large Scale Eventing for Windows
http://blogs.technet.com/b/wincat/archive/2008/08/11/quick-and-dirty-large-scale-eventing-for-windows.aspx

share|improve this answer
    
I would be worried that this type of auditing could be disabled without that being logged. It would be too easy to circumvent the logging. Interesting solution though –  Brettski Sep 28 '11 at 21:06
add comment

I've heard good things about Tripwire, although I've never been exposed to it.

share|improve this answer
1  
We use it. It does indeed audit changes. Implementing it takes a lot of work - not from the 'product' perspective, but you need to define what you're auditing, how often you're doing so, and how you're going to correlate any given change (as found by tripwire) to an approved change (in whatever your change management system is.) –  mfinni Sep 28 '11 at 15:32
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.