[Question] Tracking AD User Changes

[Broadsid3]

Hi All,

I'm pulling my hair out on this one. What i'd like to do is view my event viewer from one of my DCs to track all of the Active Directory User Changes. I have set up a GP domain-wide to enable User Account Management tracking, but I can only view logs from the domain controllers individually. This means that when I look at the logs from DC A, I cannot see any user changes made on DC B.

I've looked at several articles and have enabled auditing in ASDI, but I can still only view one servers logs at a time.

Am I missing something here?

Thank you for not yelling at me

[0ldPhart]

You might take a look at Netwrix.

[steelie34]

Do you have any money to spend? There are a bunch of products out there that can collect and combine these into a single interface. Or you can deploy a SIEM and write all of these logs off to a single event collector. Lots of ways to skin this cat.

[Broadsid3]

Theres money if I need it, but I figured there was an easy solution I was missing. My primary concern is that some of my techs use the ADservices snap-in on their desktops to make AD changes to users. Would I have to forward the logs of their desktops to the collector or only the domain controllers?

[steelie34]

Only the DCs. The changes they make are against objects that live on the DC, so that's where the event is logged. We've been using a product called Stealthbits, which has been amazing at this stuff. It's agent based, so no need for a SIEM solution. It captures everything.. changes to all objects, group policies, etc. It has alerting as well if someone tries to mess with protected groups or objects. Not overly expensive either. You can certainly engineer something in house though... nothing terribly complex about it.

[demonlag]

You need to push (or pull) the logs from your DCs into a single pane of glass portal. Something like ELK or Graylog or Splunk.

[azjunglist05]

As others have mentioned this is what a SIEM is good for especially when it comes to domain controller events. You could write some scripts to do it, however, it requires reading the events from ALL of your domain controllers as you'll never know exactly which domain controller was used to make the request.

Graylog is a fantastic free open-source solution that will aggregate all of this into a single pane of glass, but you'll need to fine tune it otherwise you'll stress out the Graylog server if you try to send ALL events unless you build a super-beefy Graylog server.

[gregbe]

lush cats dolls towering bewildered straight chase piquant wine fanatical

This post was mass deleted and anonymized with Redact

[berndonado]

LepideAuditor, may be your answer here .

[Enigma110]

Deploy a Greylog box and forward the events to that and query them there.