Active Directory Auditing??

[ICTNUT]

Hi All,

 

I am after a way that I can have changes made to AD & GPOs logged.

 

Idealy it would log what changes were made, by whom, and when.

 

Does anyone have any ideas or software they now of that can do the above.

[Oops_my_bad]

Is audit object changes no good then? You can do this via audit policies but not sure about GPO's

[ICTNUT]

Yes but this would require being at the console and then trawling through 1000's of event log entries and no GPOs are not recorded.

[ICTNUT]

UPDATE: I have found a number of software programs that will do this but boy are they expensive.

 

Looking into it I think I am going to just have to bite the bullet and write a small app to extract the events from the event log to a database with a web front end.

 

Wish me luck ;-)

[ChrisH]

If your going to do it that way look at one of the syslog solutions to grab the windows logs and put them in a database. That way you can write some routines to query for what you need.

[GrumbleDook]

The only thing I can suggest is a nightly export of the list of GPOs and running a diff to see what is different, rather than polling the event log.

 

Scripting of Group Policies can be found here

 

Whilst not as granular as things produced by companies like Quest but should do the job.

 

Is this the sort f thing you were thinking of?

[ICTNUT]

Sort of, I am wanting to have a seperate audit trail of what changes are done when and by who.

 

I currently have a windows service runninf a small app that does the export into an SQL 2005 database and this works well exporting all event logs for the server and then clearing them down after the export.

 

I am now writing a web frontend to query the data, this should allow for quick audit reports and verification of the change management process also.

[Churritos]

I can recommend NetWrix Active Directory Change Reproter. My company uses it, and it audits all changes made to AD, sending automated reports and real-time alerts highlighting details about each change—e.g., it tells me exactly what changed, who made each change, and when the change occurred. http://www.netwrix.com/active_directory_change_reporting_freeware.html

[Churritos]

I recommend looking at a few third-party options for reporting capabilities. If you’re looking for some good software I recommend NetWrix Active Change Reporter, Quest ChangeAuditor and NetIQ Change Guardian. We use NetWrix, but all three tools will audit AD changes, and send reports telling you who made them.