A.3 Configuring User and Group Auditing

This configuration enables auditing of user logons and logoffs (by both local users and Active Directory users) and local user and group settings.

You can configure user and group auditing manually or by running scripts.

A.3.1 Configuring Manually

To manually configure user and group auditing, complete the following steps.

To manually configure user and group auditing:

  1. Log in to a computer in the domain you want to configure using a user account with domain administrator privileges.

  2. Open the Microsoft Management Console, and then select File > Add/Remove Snap-in.

  3. Select Group Policy Management Editor, and then click Add.

  4. On the Select Group Policy Object window, click Browse.

  5. Select Domain Controllers.FQDN, where FQDN is the Fully Qualified Domain Name for the domain controller computer.

  6. Click Add.

  7. Select Default Domain Controllers Policy, and then click OK.

  8. Click Finish, and then click OK.

  9. In the Microsoft Management Console, expand Default Domain Controllers Policy FQDN > Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Audit Policy.

  10. Under Audit Account Logon Events, select Define these policy settings, and then select Success and Failure.

  11. Under Audit Logon Events, select Define these policy settings, and then select Success and Failure.

  12. In the Microsoft Management Console, expand Default Domain Controllers Policy FQDN > Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Logon/Logoff.

  13. Under Audit Logon, select Audit Logon, and then select Success and Failure.

  14. Under Audit Logoff, select Audit Logoff, and then select Success and Failure.

  15. To update Group Policy settings, open a command prompt and type gpupdate /force.

A.3.2 Configuring with Scripts

The following scripts enable user and group auditing:

  • ADLogonEventConfig.vbs - audits logon/logoff activity for Active Directory users logged on to the domain controller computer in your Change Guardian environment

  • CGWAuditingConfig.vbs - audits local user and group settings and logon/logoff activity for local users

  • ADPrereqConfig.vbs - audits Active Directory event generation

The scripts are part of the agent installation and are available in the Change Guardian installation directory on the agent computer (typically c:\Program Files\NetIQ\ChangeGuardianAgent\).

To run the scripts, open a command prompt and use the following syntax:

cscript.exe 'Script Name'

You can run the scripts in any order.