up vote 1 down vote favorite
2
share [g+] share [fb]

Does anyone have any recommendations for auditing changes to pre-defined AD object types? For example changes to security groups or adding / deleting or changing user objects.

Before exploring an in-house development solution is anyone aware of off-the-self products or other solutions?

We once looked at using Penrose as a proxy with it's MySql facilities but no longer have the resource to implement it.

link|improve this question
feedback

2 Answers

up vote 2 down vote accepted

Disclaimer: I work for Quest Software. I'm not selling this, and I haven't even used it personally, but I'm just laying it out there.

Quest makes a ton of Active Directory auditing and reporting tools. I've talked to people who've used Recovery Manager to pull back AD changes after they discovered somebody made changes, and there's separate products for reporting & alerting.

link|improve this answer
We use several Quest products, including Recovery Manager to monitor a massive AD with hundreds of thousands of objects. They work great in our crazy environment. – duffbeer703 May 12 '09 at 1:25
feedback
up vote 1 down vote

Symantec bought BindView and thus has Control Compliance Suite. It's intended to do just that and a whole lot more. At the very least, if your auditing settings are right, all of this information should be getting recorded in the Security event log on your DCs. If you have log management software, you should be able to monitor for the correct events. As to what events, check out Security MVP Randy Franklin Smith's Ultimate Windows Security site. He covers all of that and has published some options for log management.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.