A.2 Configuring Active Directory Auditing

This configuration enables auditing of Active Directory events and logs the events in the security event log.

You should configure the Default Domain Controllers Policy GPO with Audit Directory Service Access set to monitor both success and failure events.

To verify or set this configuration:

  1. Log in to a computer in the domain you want to configure using a user account with domain administrator privileges.

  2. Open a command prompt, type gpmc.msc and press Enter to start the Group Policy Management Console.

  3. Expand Forest > Domains > domainName > Domain Controllers.

  4. Right-click Default Domain Controllers Policy, and then click Edit.

    NOTE:Making this change to the default domain controllers policy is important because a GPO linked to the domain controller (DC) organizational unit (OU) with a higher link order can override this configuration when you restart the computer or run gpUpdate again. If your corporate standards do not allow you to modify the default domain controllers policy, create a GPO for your Change Guardian settings, add these settings to the GPO, and set it to have the highest link order in the Domain Controllers OU.

  5. Expand Computer configuration > Policies > Windows Settings > Security Settings.

  6. (Conditional) For Windows Server 2008 R2 and later, complete the following steps:

    1. In Security Settings, expand Advanced Audit Policy Configuration > Audit Policies.

    2. For CGAD and CGGP, click DS Access.

    3. For each subcategory, configure or verify the following selections:

      • Configure the following audit events

      • Success

      • Failure

    4. (Conditional) For CGAD only, define the same configuration for all subcategories of Account Management and Policy Change.

  7. (Conditional) For Windows Server 2008 and 2003, complete the following steps:

    1. In Security Settings, expand Local Policies and click Audit Policy.

    2. For CGAD and CGGP, click Audit directory service access.

    3. Configure or verify the following selections:

      • Define these policy settings

      • Success

      • Failure

    4. (Conditional) For CGAD only, configure or verify the same selections for Audit account management and Audit policy change.

  8. Return to the command prompt, type gpUpdate and press Enter.