The Security Access Control List (SACL) describes, in detail, the objects and operations to monitor. You must perform this configuration to generate events for operations that can result in, or are related to, changes in GPO data stored in Active Directory.
You must configure the following three Active Directory nodes:
The domain node
The GPO container
The sites container
You must first configure the following main domain node objects:
On the object, configure Write gPOptions and Write gPLink.
On any organizational unit inside the object, configure Write gPOptions, Write gPLink.
On the object and child objects, configure Create organizational unit objects, Delete organizational unit objects.
You can use the adsiedit.msc tool to manually configure the domain main node for the following monitoring actions:
Monitor changes in links between GPOs and the domain
Monitor OU deletions
Monitor descendant OU creations
Monitor changes in links between GPOs and OUs
Monitor OU creations inside descendent OUs
The procedures in this section utilize the adsiedit.msc tool to configure the main domain node.
NOTE:If you use Windows Server 2003, you must install the Windows Support Tools to use adsiedit.msc. To download Windows Support tools, see http://technet.microsoft.com/en-us/library/cc755948%28WS.10%29.aspx.
This procedure creates auditing entries for gPLink and gPOptions.
To configure auditing to monitor changes between GPOs and the domain:
Open a command prompt as an administrator.
At the command line, type adsiedit.msc to start the tool for configuring Active Directory objects.
In the left panel, right-click ADSI Edit > Connect to.
In the connection window, ensure Name is Default naming context and Path points to the domain to configure.
In Connection Point, select Select a well-known Naming Context.
Select Default naming context.
In Computer, select Default (Domain or server that you logged in to).
Click OK.
Click the new connection point Default naming context.
Select the node inside Default naming context. This node should be the domain node, and its name must start with DC=.
Right-click the domain node, and then click Properties.
Click the Security tab.
Click Advanced.
Click the Auditing tab.
Click Add.
Configure auditing to monitor every user.
If you are using Windows Server 2012,
Click Select a principal.
Click OK.
Type everyone.
Click OK.
For all other versions of Windows,
Type everyone.
Click OK.
Click the Properties tab.
In Apply onto, select This object only.
In the Access list, select the Successful and Failed check boxes for Write gPLink and Write gPOptions.
Click OK.
This procedure creates an auditing entry for monitoring OU creations and deletions.
To configure auditing to monitor OU creations and deletions:
Open a command prompt as an administrator.
At the command line, type adsiedit.msc to start the tool for configuring Active Directory objects.
In the left panel, right-click ADSI Edit > Connect to.
In the connection window, ensure Name is Default naming context and Path points to the domain to configure.
In Connection Point, select Select a well-known Naming Context.
Select Default naming context.
In Computer, select Default (Domain or server that you logged in to).
Click OK.
Click the new connection point Default naming context.
Select the node inside Default naming context. This node should be the domain node, and its name must start with DC=.
Right-click the domain node, and then click Properties.
Click the Security tab.
Click Advanced.
Click the Auditing tab.
Click Add.
Configure auditing to monitor every user.
If you are using Windows Server 2012,
Click Select a principal.
Click OK.
Type everyone.
Click OK.
For all other versions of Windows,
Type everyone.
Click OK.
Click the Properties tab.
In Apply onto, select This object only.
In the Access list, select the Successful and Failed check boxes for Delete.
Deselect Apply these auditing entries to objects and/or containers within this container only.
Click OK.
This procedure creates an auditing entry to monitor OU creation.
Configuring auditing to monitor descendant OU creations:
Open a command prompt as an administrator.
At the command line, type adsiedit.msc to start the tool for configuring Active Directory objects.
In the left panel, right-click ADSI Edit > Connect to.
In the connection window, ensure Name is Default naming context and Path points to the domain to configure.
In Connection Point, select Select a well-known Naming Context.
Select Default naming context.
In Computer, select Default (Domain or server that you logged in to).
Click OK.
Click the new connection point Default naming context.
Select the node inside Default naming context. This node should be the domain node, and its name must start with DC=.
Right-click the domain node, and then click Properties.
Click the Security tab.
Click Advanced.
Click the Auditing tab.
Click Add.
Configure auditing to monitor every user.
If you are using Windows Server 2012,
Click Select a principal.
Click OK.
Type everyone.
Click OK.
For all other versions of Windows,
Type everyone.
Click OK.
Click the Properties tab.
In Apply onto, select This object only.
In the Access list, select the Successful and Failed check boxes for Create Organizational Unit objects.
Click OK.
This procedure creates two auditing entries for gPLink and for gPOptions.
To configure auditing to monitor changes in links between GPOs and OUs:
Open a command prompt as an administrator.
At the command line, type adsiedit.msc to start the tool for configuring Active Directory objects.
In the left panel, right-click ADSI Edit > Connect to.
In the connection window, ensure Name is Default naming context and Path points to the domain to configure.
In Connection Point, select Select a well-known Naming Context.
Select Default naming context.
In Computer, select Default (Domain or server that you logged in to).
Click OK.
Click the new connection point Default naming context.
Select the node inside Default naming context. This node should be the domain node, and its name must start with DC=.
Right-click the domain node, and then click Properties.
Click the Security tab.
Click Advanced.
Click the Auditing tab.
Click Add.
Configure auditing to monitor every user.
If you are using Windows Server 2012,
Click Select a principal.
Click OK.
Type everyone.
Click OK.
For all other versions of Windows,
Type everyone.
Click OK.
Click the Properties tab.
In Apply onto, select Descendant Organizational Unit objects.
In the Access list, select the Successful and Failed check boxes for Write gPLink and for Write gPOptions.
Deselect Apply these auditing entries to objects and/or containers within this container only.
Click OK.
This procedure creates an auditing entry to monitor the creation of OUs within descendant OUs.
To configure auditing to monitor OUs creation within descendant OUs:
Open a command prompt as an administrator.
At the command line, type adsiedit.msc to start the tool for configuring Active Directory objects.
In the left panel, right-click ADSI Edit > Connect to.
In the connection window, ensure Name is Default naming context and Path points to the domain to configure.
In Connection Point, select Select a well-known Naming Context.
Select Default naming context.
In Computer, select Default (Domain or server that you logged in to).
Click OK.
Click the new connection point Default naming context.
Select the node inside Default naming context. This node should be the domain node, and its name must start with DC=.
Right-click the domain node, and then click Properties.
Click the Security tab.
Click Advanced.
Click the Auditing tab.
Click Add.
Configure auditing to monitor every user.
If you are using Windows Server 2012,
Click Select a principal.
Click OK.
Type everyone.
Click OK.
For all other versions of Windows,
Type everyone.
Click OK.
Click the Object tab.
In Apply onto, select Descendant Organizational Unit objects.
In the Access list, select the Successful and Failed check boxes for Create Organizational Unit objects.
Deselect Apply these auditing entries to objects and/or containers within this container only.
Click OK.
Click OK.
Click OK.
You must configure auditing of the following operations on the object and child objects in the GPO container:
Write All Properties
Delete
Modify Permissions
Modify Owner
Create All Child Objects
Delete All Child Objects
This procedure creates an auditing entry to monitor operations related to changes in GPO data.
To configure auditing to monitor changes in GPO data inside the GPO container:
Open a command prompt as an administrator.
At the command line, type adsiedit.msc to start the tool for configuring Active Directory objects.
In the left panel, right-click ADSI Edit > Connect to.
In the connection window, ensure Name is Default naming context and Path points to the domain to configure.
In Connection Point, select Select a well-known Naming Context.
Select Default naming context.
In Computer, select Default (Domain or server that you logged in to).
Click OK.
Click the new connection point Default naming context.
Select the node inside Default naming context. This node should be the domain node, and its name must start with DC=.
Right-click the domain node, and then click Properties.
Click the Security tab.
Click Advanced.
Click the Auditing tab.
In the list of child nodes of the domain node, click CN=System > CN=Policies.
NOTE:CN=Policies is the container of Group Policy objects.
Right-click CN=Policies, and then select Properties.
Click the Security tab.
Click Advanced.
Click the Auditing tab.
Click Add.
Configure auditing to monitor every user.
If you are using Windows Server 2012,
Click Select a principal.
Click OK.
Type everyone.
Click OK.
For all other versions of Windows,
Type everyone.
Click OK.
Make sure you are in the Object tab.
In Apply onto, select This object and all descendant objects.
In the Access list, select the Successful and Failed check boxes for Write All Properties, Delete, Modify Permissions, Modify Owner, Create All Child Objects, and Delete All Child Objects.
NOTE:When you check Create All Child Objects and Delete All Child Objects the other nodes related to child objects are selected automatically.
Deselect Apply these auditing entries to objects and/or containers within this container only.
Click OK.
Click OK.
Click OK.
You must configure auditing for the following site container objects to monitor links between GPOs and sites:
On the object and child objects: Create site objects, Delete site objects
On any Site inside the object: Write gPOptions, Write gPLink.
This procedure creates an auditing entry to monitor site deletions.
Configuring auditing to monitor Sites deletions:
Open a command prompt as an administrator.
At the command line, type adsiedit.msc to start the tool for configuring Active Directory objects.
In the left panel, right-click ADSI Edit > Connect to.
In the connection window, ensure Name is Default naming context and Path points to the domain to configure.
In Connection Point, select Select a well-known Naming Context.
Select Default naming context.
In Computer, select Default (Domain or server that you logged in to).
Click OK.
Click the new connection point Configuration. You may need to collapse other connection nodes to see Configuration.
Click CN=Configuration > CN=Sites.
Right-click CN=Sites, and then click Properties.
Click the Security tab.
Click Advanced.
Click the Auditing tab.
Click Add.
Configure auditing to monitor every user.
If you are using Windows Server 2012,
Click Select a principal.
Click OK.
Type everyone.
Click OK.
For all other versions of Windows,
Type everyone.
Click OK.
Click the Properties tab.
In Apply onto, select Descendant Organizational Unit objects.
In the Access list, select the Successful and Failed check boxes for Delete.
Deselect Apply these auditing entries to objects and/or containers within this container only.
Click OK.
This procedure creates an auditing entry to monitor site creations.
To configure auditing to monitor site creations:
Open a command prompt as an administrator.
At the command line, type adsiedit.msc to start the tool for configuring Active Directory objects.
In the left panel, right-click ADSI Edit > Connect to.
In the connection window, ensure Name is Default naming context and Path points to the domain to configure.
In Connection Point, select Select a well-known Naming Context.
Select Default naming context.
In Computer, select Default (Domain or server that you logged in to).
Click OK.
Click the new connection point Configuration. You may need to collapse other connection nodes to see Configuration.
Click CN=Configuration > CN=Sites.
Right-click CN=Sites, and then click Properties.
Click the Security tab.
Click Advanced.
Click the Auditing tab.
Click Add.
Configure auditing to monitor every user.
If you are using Windows Server 2012,
Click Select a principal.
Click OK.
Type everyone.
Click OK.
For all other versions of Windows,
Type everyone.
Click OK.
Click the Object tab.
In Apply onto, select This object and all descendant objects.
In the Access list, select the Successful and Failed check boxes for Create Site objects.
Select Apply these auditing entries to objects and/or containers within this container only.
Click OK.
This procedure creates auditing entries for gPLink and for gPOptions.
To configure auditing to monitor changes in links between sites and GPOs:
Open a command prompt as an administrator.
At the command line, type adsiedit.msc to start the tool for configuring Active Directory objects.
In the left panel, right-click ADSI Edit > Connect to.
In the connection window, ensure Name is Default naming context and Path points to the domain to configure.
In Connection Point, select Select a well-known Naming Context.
Select Default naming context.
In Computer, select Default (Domain or server that you logged in to).
Click OK.
Click the new connection point Configuration. You may need to collapse other connection nodes to see Configuration.
Click CN=Configuration > CN=Sites.
Right-click CN=Sites, and then click Properties.
Click the Security tab.
Click Advanced.
Click the Auditing tab.
Click Add.
Configure auditing to monitor every user.
If you are using Windows Server 2012,
Click Select a principal.
Click OK.
Type everyone.
Click OK.
For all other versions of Windows,
Type everyone.
Click OK.
Select the Properties tab.
In Apply onto, select Descendant Site objects.
In the Access list, select the Successful and Failed check boxes for Write gPLink and Write gPOptions.
Select Apply these auditing entries to objects and/or containers within this container only.
Click OK.
NOTE:When modifying the Default Domain Controllers Policy, you can avoid modifying the default GPO by creating another GPO and linking it to the domain controllers you want to monitor. That GPO should contain only the configurations required by Change Guardian, and its GPO link must be moved above others to make sure they do not override it.