Windows Server 2012 – setup audit to detect who added an User into Domain Admins Group

Auditing of activity on your [easyazon_link identifier=”0735697213″ locale=”US” tag=”wn0d5-20″] Windows Server 2012 R2 [/easyazon_link]in production is very important, especially if there is more admins that have access to the server. You want to make sure that all changes are tracked and visible to you so you are up to date on any changes made on your server. It makes your life way easier when something happen and you know where to find answer to your problem and it makes easier to troubleshoot.

Here are step to setup native auditing on your [easyazon_link identifier=”0735684715″ locale=”US” tag=”wn0d5-20″] Windows Server 2012 R2 [/easyazon_link] to detect who and when added a new user into DOMAIN ADMIN group on the server:

• Configure Audit Policy Settings by running GPMC.msc → Edit “Default Domain Policy” → Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → Audit Policy → Audit account management → Define → Success.

• Configure object-level Active Directory auditing settings by opening ADSI Edit → Connect to “Default naming context”→ Click “OK” → Right-click DomainDNS object with the name of your domain → Properties → Security (Tab) → Advanced (Button) → Auditing (Tab) → Add Principal “Everyone” → Type “Success” → Applies to “This object and Descendant objects” → Permissions: → Select all check boxes except the following: “Full Control”, “List Contents”, “Read all properties”, “Read permissions” → Click “OK”.

• Enlarge security event log capacity by running GPMC.msc → Edit “Default Domain Policy” → Computer Configuration → Policies → Windows Settings → Security Settings → Event Log → Define:
  1. Maximum security log size to 1Gb
  2. Retention method for security log to “Overwrite events as needed”.

Run “gpupdate /force” command.

• Run eventvwr.msc and filter security log for event id 4728 to detect when users are added to security-enabled global groups. The group name in our case is “Domain Admins”.

Recommended book:

[easyazon_image align=”none” height=”160″ identifier=”1449320759″ locale=”US” src=”http://blog.technotesdesk.com/wp-content/uploads/2015/09/51EJXSR4YGL._SL160_.jpg” tag=”wn0d5-20″ width=”125″]