Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want to setup auditing so I can see if any changes are being made to a service account (any changes) in AD which is used to run a backup application.

What do I need to enable in Group Policy Management: Audit Directory Service changes, or Audit Account Management?

share|improve this question

3 Answers 3

up vote 5 down vote accepted

You can enable the Directory Service Changes feature, which was introduced in Windows 2008. This has the added benefit of recording both the current and previous values of an attribute when a modification occurs.

Warning: If you configure this setting in Group Policy, this is covered in the new auditing section as "DS Access". You should use either the new auditing settings or the older auditing section, but not both. When settings in the new auditing section are used, any settings in the old section may be ignored.

New location:

Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration

Old Location:

Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy.

It is possible to configure this using the auditpol.exe command, however if that method is used, it should be performed as a Computer startup script to ensure that the settings are in effect when the computer restarts. This is the command:

auditpol /set /subcategory:"directory service changes" /success:enable

You also need to enable auditing in AD Users and Computers:

  • Run Active Directory Users and Computers.

  • Right-click the organizational unit (OU) (or any object) for which you want to enable auditing, and then click Properties.

  • Click the Security tab, click Advanced, and then click the Auditing tab.

  • Click Add, and under Enter the object name to select, type Authenticated Users (or any other security principal), and then click OK.

  • In Apply onto, click Descendant User objects (or any other objects).

  • Under Access, select the Successful check box for Write all properties.

  • Click OK until you exit the property sheet for the OU or other object.

More information:

AD DS Auditing Step-by-Step Guide
http://technet.microsoft.com/en-us/library/cc731607%28v=ws.10%29.aspx

Which Versions of Windows Support Advanced Audit Policy Configuration?
http://technet.microsoft.com/en-us/library/dd692792(WS.10).aspx

"Using both the basic audit policy settings under Local Policies\Audit Policy and the advanced settings under Advanced Audit Policy Configuration can cause unexpected results. Therefore, the two sets of audit policy settings should not be combined. If you use Advanced Audit Policy Configuration settings, you should enable the Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings policy setting under Local Policies\Security Options. This will prevent conflicts between similar settings by forcing basic security auditing to be ignored."

share|improve this answer

Audit directory service changes is available from Windows Server 2008 R2 and later versions.The events which are comes under this category includes the extra details like Old Value and New Value of the changed properties.This Advanced Audit Policy comes under the subcategory of DS Access.

You can enable Advanced Audit Policy setting in the following two ways.

  1. Go to the node. Computer Configuration->Policies->Windows Settings->Security Settings->Advanced Audit Policy Configuration -> DS Access

    2.Now edit Audit directory service changes as success

or you can do it by auditpol

Auditpol /set /subcategory:"Directory Service Changes" /success:enable

Refer these article http://www.morgantechspace.com/2013/08/how-to-enable-active-directory-change.html

http://www.morgantechspace.com/2013/08/active-directory-change-audit-events.html

Note: you need to run the command gpupdate /force after completing above steps.

share|improve this answer

And event IDs you should monitor are: 1) 4625 - Account Disabled 2) 4625 - Account Expired 3) 4624, 4625 - Logins 4) 4724 - password set 5) 4726 - account deleted 6) 4730, 4734, 4748, 4753, 4758, 4763 - group member added (different types of groups).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.