Domain controller audit log

Question

I am part of an internal software development group for an enterprise. We are being asked to build an Active Directory management web application. 1 of the primary reasons is the need to generate audit logs for operations that users do such as creating/deleteing objects, updating attributes, adding/removing members, etc.

My initial position is that all this functionality is already available in so many tools, such as the active directory users and groups snap in, why not just report on the domain controller logs and call it a day.

My understanding is that the domain control logs everything to the event log. Due to the amount of entries, our logs have a 2 day or so retention window, and because of the vast types of operations being logged getting the specific events we want is almost like finding a needle in a haystack.

Rather than building an application just so we can include our own audit logging in it, is there configuration or reporting that we can employ on the domain controller to make the audit logging more usable?

Answer 1

I find that Microsoft's LogParser works well for retrieving audit logging from my domain controllers event logs.

I use LogParser to retrieve the events from Anton Chuvakin's Critical Log Review Checklist into an SQL database, and from there can manipulate the data into the format that I need for reporting. You can also use LogParser to run the SQL queries directly against the log files, but as you only keep the logs for two days unless you're creating daily point in time reports that may not be as useful.