Active Directory Group Membership Change Monitoring

[Guest]

I need Active Directory Group Membership Change Monitoring. I can find when
a group was changed but not who changed it.

 

[Joe Richards [MVP]]

You need to enable AD auditing or buy third party products to get the who.

 

[Guest]

How would we go about enabling auditing on the DC? Which part of the event
viewer will the information be displayed?

 

[Joe Richards [MVP]]

http://support.microsoft.com/default.aspx?scid=kb;en-us;314977&sd=tech

Once you have AD auditing enabled you will need to set the auditing ACEs on the
objects you want audited just like any other security auditing in Windows.

The events would show up in the security log with other audit events.

 

[Brian Desmond [MVP]]

There's some 600 series events logged in the sec log of the DC where a group
add/drop is originated. It includes who did it, who was added/removed, and
some other useful information. I found the information as to all the
eventids in the MS Press Security Res kit which is on technet or your local
bookstore.

I collect all this information into a large sql database and produce sql
report services reports.

--
Thanks,
Brian Desmond
Windows Server MVP

www.briandesmond.com

 

[Jorge_de_Almeida_Pinto]

I need Active Directory Group Membership Change Monitoring. I
can find when
a group was changed but not who changed it.

if auditing is enabled and configured you will also be able to see who
made the change

 

[Guest]

Hi Joe,
Can you recommend any 3rd party software that can do this Monitoring??

 

[Joe Richards [MVP]]

I would recommend looking at the NETPRO and QUEST tool sets.

--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm

============================================================================
Do not read this worthless blog entry on
Defending Security Infrastructures http://blog.joeware.net/2006/07/11/445/
I'm serious, you will learn absolutely nothing about
Defending Security Infrastructures.
============================================================================

 

[Rob]

You might want to try netwrix active directory change reporter. It track
changes in all AD, and it's especially helpful because it show what changes
were made, who made those change and when.
Best wishes,
Robert Harris.

 

[Bobby Arts]

+ 1 for Netwrix, really nice product and much less expensive than Quest. BTW NetPro doesn't exist anymore (purchased by Quest).

 

[aidansimister]

Yeah - again, I'd definitely take a look at the NetWrix offerings.... Active Directory, Exchange, Group Policy... Change Auditing.. quite a few of their tools are free aswell... www.netwrix.co.uk