Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does anyone have any recommendations for auditing changes to pre-defined AD object types? For example changes to security groups or adding / deleting or changing user objects.

Before exploring an in-house development solution is anyone aware of off-the-self products or other solutions?

We once looked at using Penrose as a proxy with it's MySql facilities but no longer have the resource to implement it.


locked by Iain Mar 26 '13 at 11:40

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

up vote 3 down vote accepted

Disclaimer: I work for Quest Software. I'm not selling this, and I haven't even used it personally, but I'm just laying it out there.

Quest makes a ton of Active Directory auditing and reporting tools. I've talked to people who've used Recovery Manager to pull back AD changes after they discovered somebody made changes, and there's separate products for reporting & alerting.

We use several Quest products, including Recovery Manager to monitor a massive AD with hundreds of thousands of objects. They work great in our crazy environment. – duffbeer703 May 12 '09 at 1:25

Symantec bought BindView and thus has Control Compliance Suite. It's intended to do just that and a whole lot more. At the very least, if your auditing settings are right, all of this information should be getting recorded in the Security event log on your DCs. If you have log management software, you should be able to monitor for the correct events. As to what events, check out Security MVP Randy Franklin Smith's Ultimate Windows Security site. He covers all of that and has published some options for log management.


Not the answer you're looking for? Browse other questions tagged or ask your own question.