Active Directory Audit Logs

[LCL]

I have ben trying to locate information on the type of
audit logging that is available with Active Directory
Administration tools. More specifically I would like to
know if administration activities are logged somewhere
stuff like creation of users, changes to user profiles
etc..., if so what is logged and where is it logged and
how does one go about turning this logging on?

Thanks.

 

[Tim Hines [MSFT]]

You can enable "account mangement auditing". The activities will be saved
on the security log.

Here is more info:

300549 HOW TO: Enable and Apply Security Auditing in Windows 2000
http://support.microsoft.com/?id=300549
and
Audit account management
Computer Configuration\Windows Settings\Security Settings\Local
Policies\Audit Policy

Description
Determines whether to audit each event of account management on a computer.
Examples of account managment events include:

a.. A user account or group is created, changed, or deleted
b.. A user account is renamed, disabled, or enabled
c.. A password is set or changed
By default, this value is set to No auditing in the Default Domain
Controller Group Policy object (GPO) and in the local policies of
workstations and servers.

If you define this policy setting, you can specify whether to audit
successes, audit failures, or not to audit the event type at all. Success
audits generate an audit entry when any account management event is
successful. Failure audits generate an audit entry when any account
management event fails. You can select No auditing by defining the policy
setting and unchecking Success and Failure.


--
Tim Hines, MCSE, MCSA
Windows 2000 Directory Services

=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.