Re: Find who added an account to domain admins group

For AD objects you have two types of auditing:
(1) "Audit Account Management"
(2) "Audit directory service access"

(1) is enable by default for successes and will audit several actions
against security principals (users,groups, computers)
(2) is enable by default for successes and will audit several actions
against all AD objects. However for this to work you still need to define a
SACL (System Access Control List) on a(n) object(s) for WHAT action by WHO

However if you have multiple DCs how do you know where the change occured? Well, that is also
easy. Membership of a group is stored in the MEMBER attribute of the group.

Running the following command will show you where a change originated:
repadmin /showobjmeta <some DC> "<domain admins DN>"

check the originating DSA which is where the change occured. If you have W2K3 and FFL=W2K3 (LVR) you will be able to see the particular forward link which represents the user who was added to the group. If you do not have FFL=W2K3 you should look at the member attribute.
In both cases record the originating DSA, date and time. Then go the DC (DSA) and search the security log (same date and time). If not available anymore you can restore the security event log file and load into the event viewer


--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Windows Server - Directory Services

BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx
------------------------------------------------------------------------------------------
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always test before implementing!
------------------------------------------------------------------------------------------
#################################################
#################################################
------------------------------------------------------------------------------------------
"Peter Read" <PeterRead@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:DB882EBD-94EE-4D73-951B-1B2411949194@xxxxxxxxxxxxxxxx
Ok, anyone got any ideas on the following;

An account 'magically' appears in the domain admins group. Event logs are
all set to overwrite as needed (sure, maybe a mistake) and no sign of the
addition in what's online now. Not sure when the account was added to the
group, but am pretty sure it was within the last month.

Is there any moderately quick (i.e. without resorting to restoring DC
backups in a lab environment) way to determine who added the account to the
group, or do I have to chalk this up to experience and keep a tighter watch
on things in the future?

.

Relevant Pages

  • Re: user accounts are reappearing
    ... is a policy setting called "audit account management" that you can enable. ...
    (microsoft.public.win2000.active_directory)
  • Re: ADAM Security Logging
    ... so if you look at the effective local security policy on the ADAM ... "Audit account management". ... account "Generate security audits" right in User Rights Assignment ...
    (microsoft.public.windows.server.active_directory)
  • RE: 2 SBS2003 Questions...
    ... It is important to us that we provide you with the best support possible ... you can use the Account locked out policy in Group Policy to reach ... I suggest you enable User logon audit to monitor the event log to see ...
    (microsoft.public.windows.server.sbs)
  • Re: Audit trail of AD Account
    ... >When the administrator disable an account in Active Directory. ... >way to set up audit trail that will show when the account is being disabled? ... Determines whether to audit each event of account management on a computer. ... Success audits generate an audit entry when any account management event succeeds. ...
    (microsoft.public.win2000.active_directory)
  • Re: event id 836 and 837?
    ... directory service access such as auditing access of particular AD objects ... This policy setting determines whether to audit user access of an Active ... A SACL is list of users and groups for which actions on ... Directory object that has a SACL that requires auditing. ...
    (microsoft.public.windows.server.security)
Loading