Home > Security Measures > Audit Changes to Privileged Accounts and Groups

Audit changes to Active Directory privileged accounts and groups

Configuring security auditing to audit all critical changes made to all Active Directory privileged accounts and groups can be very useful in detecting suspicious/nefarious activities, and constitues yet another important Active Directory Security Measure.


Note - To enable auditing of changes to privileged accounts and groups in Active Directory, Audit Policies need to be enabled in the default Domain Controllers Policy, Audit Directory Services Access needs to be configured in Active Directory Auditing, and SACLs need to be configured in Active Directory.


To audit critical changes made to all Active Directory privileged accounts and groups, configure the SACL on the AdminSDHolder object, and on all objects that represent* admin accounts and groups but are not covered by AdminSDHolder, as follows -

* AdminSDHolder only protects those administrative groups (, and their members) that are considered to be administrative in nature by default. It is certainly possible that there exist other accounts and groups that possess equivalent privileged access but that are not members of any of the default admin groups. For example, if one were to create a group called Universal Admins and grant it inhertiable Full Control permissions on all partition roots, this group will possess almost Enterprise Admin equivalent privileged access, yet it will not automatically fall under security umbrella of AdminSDHolder protection.

For guidance on how to identify all accounts and groups that possess unrestricted privileged access in Active Directory, click here


Type
 		 Name
.		 Access
.		 Apply To
.
Success
Everyone
Modify Permissions, Modify Owner, Write all Properties, All Extended Rights
This object only



Note - The audit settings specified above will ensure that an audit entry is generated whenever someone successfully enacts any of the following operations on any administrative account or group in Active Directory -

  1. Change permissions on the AdminSDHolder object or on any administrative account or group
  2. Change the ownership of the AdminSDHolder object or of any administrative account or group
  3. Reset the password of any administrative account
  4. Change the Smart card is required for interactive logon setting on any administrative account
  5. Change the Account is sensitive and cannot be delegated flag on any administrative account
  6. Change the Do not require Kerberos pre-authentication flag on any administrative account
  7. Change the User Principal Name of on any administrative accounts
  8. Change the membership of any administrative group
  9. Add/remove one's own account to any administrative group
  10. Change any attribute on any administrative account or group