Direct Inward Dialing: +1 408 916 9892
From authenticating logons and authorizing file access, to categorizing users into groups and controlling security settings, AD serves as the backbone of an organization's IT infrastructure. Auditing provides visibility into activities happening across an AD environment and is crucial for keeping it secure and compliant.
However, auditing has a steep learning curve. This checklist provides concise information on AD auditing to simplify the process for you. It will guide you through the auditing settings to enable logging, the event IDs to track, the limitations of native auditing, and more.
Advanced audit policies and object-level auditing settings, also called system access control lists (SACLs), should be configured to ensure that events are logged whenever any AD activity occurs.
Advanced audit policies should be configured for computers and can be accomplished using the Group Policy Management Console (GPMC). In a Group Policy Object (GPO), advanced audit policies can be found under: Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policy.
The categories of settings that need to be configured for AD auditing are:
SACLs should be configured for secured objects such as users, groups, OUs, and GPOs. SACLs can be configured using Active Directory Users and Computers by accessing the Advanced Security Settings of an object's properties.
This ensures advanced audit policy settings are applied over basic audit policy settings. To do this, navigate to Local Policies > Security Options, and enable "Audit: Force audit policy subcategory settings" to override audit policy category settings.
Note: Microsoft recommends configuring advanced audit policy settings on systems running Windows Server 2008 R2 and above, or Windows 7 and above.
For each advanced audit policy setting, you can choose to log successes, failures, both, or neither.
To enable logging on all computers in a domain, link the GPO containing the advanced audit policy settings to the domain. To enable logging on specific computers, link the GPO to an OU that contains those computers.
Choose the settings based on the activities, resources, and users you want to track, and consider the event volume each setting generates. Poor planning can either cause you to miss critical activities or flood you with too many events, making it harder to identify suspicious activity.
Run the Group Policy Results Wizard from GPMC to view the effective audit settings that will be applied.
Note: Microsoft does not provide a tool to consolidate and display all SACLs across an environment.
Event log settings should be configured to ensure that events are stored properly. If the event log size is too small, events might be overwritten, and audit data could be lost.
To prevent this:
Note: It is recommended that event logs hold at least 12 hours of audit data of your environment.
ManageEngine ADAudit Plus provides capabilities like change auditing, logon monitoring, file tracking, compliance reporting, attack surface analysis, response automation, and backup and recovery for diverse IT systems.
Active Directory | Microsoft Entra ID | Windows file servers | NAS file servers | Windows servers | Workstations | And more
There are hundreds of events related to AD auditing. Some of the most important ones include:
Audit logon
Audit user account management
Audit computer account management
Audit security group management
Audit directory service access
Audit detailed directory service replication
Other events
ADAudit Plushelps audit all of the above events. It transforms the data contained in these events into insightful reports and real-time alerts with just a few clicks.
Event logs do not get replicated, making it impractical for admins to manually review logs on each computer. To centralize auditing, logs must be aggregated. Windows Event Forwarding (WEF) can send specific events to a Windows Event Collector server. However, setting up WEF requires expertise, considering factors like system health, cross-domain forwarding, load balancing, and event subscriptions.
ADAudit Plus compiles data from all configured computers across the domain and provides a central repository of audit information with just a few clicks.
Each Windows activity generates multiple events. For example, a simple logon creates events on both the workstation and the DC. With many users and activities, event volume quickly becomes overwhelming, making it hard to spot critical actions manually. Task Scheduler and PowerShell can trigger emails for specific event IDs, but Windows can't flag unusual patterns, like a logon from a disabled account.
ADAudit Plus' alerts let you define thresholds based on the volume, time, and other criteria todetect critical activities such as logons from a disabled account. You can get instantly notified via email and SMS of such activities. UBA can be leveraged to establish activity patterns and spot subtle anomalies, such as an unusual volume of privileged user activity, that go under the radar of conventional detection systems. You can also execute scripts to automate response actions, like shutting down a device to mitigate the impact of a security incident.
Windows events often provide limited information. For example, AD attribute changes are split across events, requiring manual correlation. Regulations demand capturing such details in real time. While PowerShell can help correlate events and resolve GPO names, it requires deep expertise, extensive testing, and isn't ideal for real-time auditing, especially in large environments.
ADAudit Plus' built-in reports provide real-time information on the before and after values of AD changes. You can also automate the generation and delivery of built-in reports to pass compliance audits with ease.
Free Edition
