Home > Security Measures > Audit Changes to Critical Active Directory Contents

Audit changes to critical Active Directory contents

Configuring security auditing to audit changes to critical Active Directory contents can also be very useful in detecting suspicious/nefarious activities in or against an Active Directory, and constitues yet another important Active Directory Security Measure.


Note - To enable auditing of changes to Active Directory contents, Audit Policies need to be enabled in the default Domain Controllers Policy, Audit Directory Services Access needs to be configured in Active Directory Auditing, and SACLs need to be configured in Active Directory.


To audit changes made to critial Active Directory contents, configure the SACL on the following objects in Active Directory, as follows -


  1. Domain Partition

    1. Domain root     (DC=<Domain>)

      Configure the SACL on this object as follows -

      Type
             		 Name
      .      		 Access
      .      		 Apply To
      .
      Success
      Everyone
      Modify Permissions, Modify Owner, Write all Properties
      This object only
      Success
      Everyone
      Extended Right - Change PDC
      This object only
      Success
      Everyone
      Extended Right - Migrate SID History
      This object only
      Success
      Everyone
      Extended Right - Create Inbound Forest Trust
      This object only


      Note - The last ACE above need only be set in the SACL of the domain root object of the forest root domain.


      Note - The audit settings specified above will ensure that an audit entry is generated whenever someone successfully enacts any of the following operations on the domain root -

      1. Change permissions on the domain root
      2. Change the ownership of the domain root
      3. Link a Group Policy to the domain root
      4. Change the DC that holds the PDC Emulator role
      5. Migrate SID History without administrator privileges
      6. Create an inbound forest trust (to the forest root domain)
      7. Modify valid DNS Suffixes for the domain (i.e. the ms-DS-Allowed-DNS-Suffixes attribute)
      8. Change any attribute on the domain root (including the wellKnownObjects attribute)



    2. Domain Controllers Organizational Unit (OU)     (CN=Domain Controllers,DC=<Domain>)

      Configure the SACL on this object as follows -

      Type
             		 Name
      .      		 Access
      .      		 Apply To
      .
      Success
      Everyone
      Modify Permissions, Modify Owner
      This object only
      Success
      Everyone
      Create Child, Delete Child - Computer objects
      This object only
      Success
      Everyone
      Write Property - gPLink, gPOptions
      This object only


      Note - The audit settings specified above will ensure that an audit entry is generated whenever someone successfully enacts any of the following operations on (or related to) the Domain Controllers OU -

      1. Change permissions on the Domain Controllers OU
      2. Change the ownership of the Domain Controllers OU
      3. Link a Group Policy to the Domain Controllers OU
      4. Add or remove domain controllers to/from the domain



    3. Infrastructure Organizational Unit (OU)     (CN=Infrastructure,DC=<Domain>)

      Configure the SACL on this object as follows -

      Type
             		 Name
      .      		 Access
      .      		 Apply To
      .
      Success
      Everyone
      Modify Permissions, Modify Owner
      This object only
      Success
      Everyone
      Extended Right - Change Infrastructure Master
      This object only


      Note - The audit settings specified above will ensure that an audit entry is generated whenever someone successfully enacts any of the following operations on (or related to) the Infrastructure OU -

      1. Change permissions on the Infrastructure OU
      2. Change the ownership of the Infrastructure OU
      3. Change the DC that holds the Infrastructure Master role



    4. Policies Container     (CN=Policies,CN=System,DC=<Domain>)

      Configure the SACL on this object as follows -

      Type
             		 Name
      .      		 Access
      .      		 Apply To
      .
      Success
      Everyone
      Modify Permissions, Modify Owner, Create All Child Objects, Delete All Child Objects
      This object only
      Success
      Everyone
      Modify Permissions, Modify Owner, Write All Properties
      Descendant groupPolicyContainer objects


      Note - The audit settings specified above will ensure that an audit entry is generated whenever someone successfully enacts any of the following operations on (or related to) the Policies container -

      1. Change permissions on the Policies container
      2. Change the ownership of the Policies container
      3. Create or delete GPOs
      4. Modify any property on GPOs



    5. RID Manager$ object     (CN=RID Manager$,CN=System,DC=<Domain>)

      Configure the SACL on this object as follows -

      Type
             		 Name
      .      		 Access
      .      		 Apply To
      .
      Success
      Everyone
      Modify Permissions, Modify Owner
      This object only
      Success
      Everyone
      Extended Right - Change Rid Manager
      This object only


      Note - The audit settings specified above will ensure that an audit entry is generated whenever someone successfully enacts any of the following operations on (or related to) the RID Manager$ object -

      1. Change permissions on the RID Manager$ object
      2. Change the ownership of the RID Manager$ object
      3. Change the DC that holds the RID Operations Master role



    6. AdminSDHolder object     (CN=AdminSDHolder,CN=System,DC=<Domain>)

      Configure the SACL on this object as follows -

      Type
             		 Name
      .      		 Access
      .      		 Apply To
      .
      Success
      Everyone
      Modify Permissions, Modify Owner, Write all Properties, All Extended Rights
      This object only


      Note - The audit settings specified above will ensure that an audit entry is generated whenever someone successfully enacts any of the following operations on (or related to) the AdminSDHolder object -

      1. Change permissions on the AdminSDHolder object and on all administrative accounts and groups protected by AdminSDHolder
      2. Change the ownership of the AdminSDHolder object and on all administrative accounts and groups protected by AdminSDHolder
      3. Change any attribute on the AdminSDHolder object and on all administrative accounts and groups protected by AdminSDHolder


      Important - This ACE will only cover those administrative accounts and groups that are covered by AdminSDHolder. It will not cover ALL administrative accounts and groups. For additional information and guidance, click here.





  2. Configuration Partition

    1. Configuration root     (CN=Configuration,DC=<Domain>)

      Configure the SACL on this object as follows -

      Type
             		 Name
      .      		 Access
      .      		 Apply To
      .
      Success
      Everyone
      Modify Permissions, Modify Owner, Write All Properties
      This object only


      Note - The audit settings specified above will ensure that an audit entry is generated whenever someone successfully enacts any of the following operations on the Configuration partition root -

      1. Change permissions on the Configuration partition root object
      2. Change the ownership of the Configuration partition root object
      3. Change any attribute on any Configuration partition root object (, including the wellKnownObjects attribute)



    2. Partitions Container     (CN=Partitions,CN=Configuration,DC=<Domain>)

      Configure the SACL on this object as follows -

      Type
             		 Name
      .      		 Access
      .      		 Apply To
      .
      Success
      Everyone
      Modify Permissions, Modify Owner, Create All Child Objects, Delete All Child Objects, Write All Properties
      This object only
      Success
      Everyone
      Extended Right - Change Domain Master
      This object only


      Note - The audit settings specified above will ensure that an audit entry is generated whenever someone successfully enacts any of the following operations on (or related to) the Partitions container -

      1. Change permissions on the Partitions container
      2. Change the ownership of the Partitions container
      3. Change the DC that holds the Domain Master FSMO role
      4. Change any attribute on the Partitions container object (, including the uPNSuffixes attribute and the msDS-SPNSuffixes attribute)
      5. Add or remove a domain from the forest



    3. Sites Container     (CN=Sites,CN=Configuration,DC=<Domain>)

      Configure the SACL on this object as follows -

      Type
             		 Name
      .      		 Access
      .      		 Apply To
      .
      Success
      Everyone
      Modify Permissions, Modify Owner
      This object only
      Success
      Everyone
      Create Child, Delete Child - Domain Controller Settings (NTDS-DSA) objects
      Descendant Server objects
      Success
      Everyone
      Write Property - gPLink, gPOptions
      Descendant Site objects
      Success
      Everyone
      Write Property - siteObject
      Descendant Subnet objects


      Note - The audit settings specified above will ensure that an audit entry is generated whenever someone successfully enacts any of the following operations on (or related to) the Sites container -

      1. Change permissions on the Sites container
      2. Change the ownership of the Sites container
      3. Link a Group Policy to any site in the forest
      4. Add or remove a site to/from a subnet
      5. Add or remove domain controllers to/from the forest



    4. Directory Service object     (CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=<Domain>)

      Configure the SACL on this object as follows -

      Type
             		 Name
      .      		 Access
      .      		 Apply To
      .
      Success
      Everyone
      Modify Permissions, Modify Owner
      This object only
      Success
      Everyone
      Write Property - dSHeuristics
      This object only


      Note - The audit settings specified above will ensure that an audit entry is generated whenever someone successfully enacts any of the following operations on the Directory Service object -

      1. Change permissions on the Directory Service object
      2. Change the ownership of the Directory Service object
      3. Modify certain behavorial aspects (e.g. Visbility Mode etc.) of the directory service for the forest



    5. Default Query Policy object     (CN=Default-Query-Policy,CN=Query-Policies,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=<Domain>)

      Configure the SACL on this object as follows -

      Type
             		 Name
      .      		 Access
      .      		 Apply To
      .
      Success
      Everyone
      Modify Permissions, Modify Owner
      This object only
      Success
      Everyone
      Write Property - lDAPAdminLimits
      This object only


      Note - The audit settings specified above will ensure that an audit entry is generated whenever someone successfully enacts any of the following operations on the Default Query Policy object -

      1. Change permissions on the Default Query Policy object
      2. Change the ownership of the Default Query Policy object
      3. Modify LDAP Administration limits (e.g. Maximum Active Queries etc.) for the forest





  3. Schema Partition

    1. Schema root     (CN=Schema,CN=Configuration,DC=<Domain>)

      Configure the SACL on this object as follows -

      Type
             		 Name
      .      		 Access
      .      		 Apply To
      .
      Success
      Everyone
      Modify Permissions, Modify Owner
      This object only
      Success
      Everyone
      Extended Right - Change Schema Master
      This object only
      Success
      Everyone
      Write All Properties
      This object and all child objects


      Note - The audit settings specified above will ensure that an audit entry is generated whenever someone successfully enacts any of the following operations in the Active Directory Schema -

      1. Change permissions on the Schema partition root object
      2. Change the ownership of the Schema partition root object
      3. Change the DC that holds the Schema Master FSMO role
      4. Change any attribute on any Class or Attribute definition (object) in the Schema