I need to implement change control and auditing in a Microsoft Windows network environment. My question is in methods to audit or better yet changes made to the networking environment. This starts with all Active Directory changes. I would also like to extend this out to network equipment (e.g. firewalls, routers, switches), and servers.

Having the automated audit of changes in the network will allow us to verify submitted change controls and accuracy of those changes.

Do you have suggestions on software which excels in this area?

closed as off-topic by HopelessN00b Jan 22 '15 at 7:27

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

locked by HopelessN00b Jan 22 '15 at 7:27

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. See the help center for guidance on writing a good question.

Read more about locked posts here.


For the Active Directory part, there is a feature/aspect that you may want to be aware of.

Windows 2008 introduced the ability to audit creation, deletion, moves, and modification of objects. The information includes who performed the auditable event, and the DN of the object. In the case of modifications, two events are recorded, which essentially provides you with the current and previous values.

This is enabled on a DC with the following command:

auditpol /set /subcategory:"directory service changes" /success:enable  

You also need to enable success auditing in AD Users & Computers, typically at the domain level.

When you combine this with event log forwarding, the result is a very powerful and convenient capability. For example, we configure our dc's to forward event id's 5136-5139,5141 to the "Forwarded Events" event log on a central utility server.

A simple pull subscription from the collection server to the DC's in highly selective XPath query to filter noise can easily bring what you need to a single location, where it can be archived, reported on, or imported into another reporting system. Here is an example of such as query:

  <Query Id="0" Path="Security">
    <Select Path="Security">*[System[( (EventID &gt;= 5136 and EventID &lt;= 5139)  or EventID=5141) and TimeCreated[timediff(@SystemTime) &lt;= 3600000]]]</Select>
    <Suppress Path="Security">*[EventData[Data="S-1-5-18"]]</Suppress>
    <Suppress Path="Security">*[EventData[Data[@Name="AttributeLDAPDisplayName"] = "dNSTombstoned"]]</Suppress>
    <Suppress Path="Security">*[EventData[Data[@Name="AttributeLDAPDisplayName"] = "dnsRecord"]]</Suppress>
    <Suppress Path="Security">*[EventData[Data[@Name="AttributeLDAPDisplayName"] = "msExchExpansionServerName"]]</Suppress>
    <Suppress Path="Security">*[EventData[Data[@Name="AttributeLDAPDisplayName"] = "msExchServer1HighestUSNVector"]]</Suppress>
    <Suppress Path="Security">*[EventData[Data[@Name="AttributeLDAPDisplayName"] = "msExchMessageJournalRecipient"]]</Suppress>
    <Suppress Path="Security">*[EventData[Data[@Name="objectClass"] = "dnsNode"]]</Suppress>
    <Suppress Path="Security">*[EventData[Data[@Name="objectClass"] = "printQueue"]]</Suppress>
    <Suppress Path="Security">*[EventData[Data[@Name="objectClass"] = "serviceConnectionPoint"]]</Suppress>
    <Suppress Path="Security">*[EventData[Data[@Name="objectClass"] = "msExchAddressListService"]]</Suppress>

There are some things that need to be configured for subscriptions to work properly. Some can be done in a group policy.

More information:

AD DS Auditing Step-by-Step Guide

Configure Computers to Forward and Collect Events

Quick and Dirty Large Scale Eventing for Windows

  • I would be worried that this type of auditing could be disabled without that being logged. It would be too easy to circumvent the logging. Interesting solution though – Brettski Sep 28 '11 at 21:06

I've heard good things about Tripwire, although I've never been exposed to it.

  • 1
    We use it. It does indeed audit changes. Implementing it takes a lot of work - not from the 'product' perspective, but you need to define what you're auditing, how often you're doing so, and how you're going to correlate any given change (as found by tripwire) to an approved change (in whatever your change management system is.) – mfinni Sep 28 '11 at 15:32

Not the answer you're looking for? Browse other questions tagged or ask your own question.