We had a request today to monitor actual changes to group membership in real time. Real time? is that possible? Hmmm.

There are many commercial tools that monitor and manage event logs, but we had to work with the current monitoring system and Windows.

Task: Report changes made to group memberships in Active Directory.

Now I’ve got access to Enterprise Security Reporter which would be ideal for monitoring the changes between 2 dates but this doesn’t work in real time. I’ve looked at Powershell, but again the script would run on a scheduled task.

Solution: Enable auditing on domain controller and watch the event logs.

Yes, it is as simple as that and to make it even easier your can enable a Group Policy on all the domain controllers to ensure this option is set.

Steps:

  1. On your domain controller open Start > Administration Tools > Domain Controller Security Policy
  2. Expand Local polices and click on Audit Policy
  3. Edit Audit account management and select Success
  4. Do this to all your Domain Controllers or Apply a GPO (See below)
  5. Watch the event log for the following Event IDs

Event IDs:

631 = Global Group Created

632 = Global Group Member Added

633 = Global Group Member Removed

634 = Global Group Deleted

641 = Global Group Changed

Now I guess your wondering how do we make use of this information? Well in this case our monitoring system will look for the the above event and push them to an SQL database, we can then query them later or create reports.

Group Policy

You can add this rule to your existing GPO, but I prefer to create a new GPO for each rule and then apply to a security group.

Steps:

  1. Open the GPO editor
  2. Create a new policy and give it a name
  3. Expand Computer Configuration > Windows Settings > Local policies > Audit Policy
  4. Select Audit account management
  5. Check the boxes Define these policy settings and  Success
  6. Apply this GPO all the Domain Controllers or use a security group

It is assumed you have some kind of monitoring system that will read the event logs and that will alert or record changes.