Security auditing on your domain

[tosca925]

I just wondered why sort of security auditing you do on your domain. I went to a another school today who don't use any which i found strange. I just wondered what type of auditing you do on your domains and what you think is essential and why.

 

Especially your thoughts of auditing servers when you have several domain admins changing things on a daily basis.

[localzuk]

I don't really do much - other than the Microsoft Baseline Security Analyzer, manually checking there weren't any extra admins on machines in the AD and keeping an eye on logons from the couple of admin machines in the event log (checking which machines they logged on from, as only a couple of machines ever make use of them unless I'm repairing one).

 

None of this is formal though.

[Geoff]

Yes, the MBSA tool is a good start. I also use Nessus.

 

http://www.nessus.org/

 

Long term I want to roll out Packetfence as a NAC solution, which will allow me to be much more pro-active about host system security in an automated fashion.

 

http://www.packetfence.org/