Change Guardian monitors the following in Active Directory (AD):
AD objects
AD query
Computer accounts
Configurations
Contacts
DNS Configuration
Federation Service
Groups
Organization units
Schema
Trusts
User accounts
This chapter provides information about the following:
Complete the following tasks to start monitoring Windows Active Directory audit events:
|
Task |
See |
|---|---|
|
Review requirements and recommendations for computers running the AD Domain Service |
|
|
Complete the prerequisites |
|
|
Add the license key |
|
|
Configure Change Guardian for monitoring |
Categories of Change Guardian Policies for Windows Active Directory |
|
Triage events |
Ensure that you have completed the following:
Complete the following tasks to allow Change Guardian to monitor Active Directory events.
NOTE:Change Guardian documentation provides the third-party configuration steps for ease of use. For more information about the third-party products or for any issues with the configuration, see their documentation.
NOTE:Ensure that you have the required permission to complete these tasks. Check with your network or system administrator for assistance.
Configure the security event log to ensure that Active Directory events remain in the event log until Change Guardian processes them.
To configure the security event log:
Log in as an administrator to a computer in the domain that you want to configure.
To open Group Policy Management Console, enter the following at the command prompt: gpmc.msc
Open Forest > Domains > domainName> Domain Controllers.
Right-click Default Domain Controllers Policy, and then click Edit.
NOTE:Changing the default domain controllers policy is important because a GPO linked to the domain controller (DC) organizational unit (OU) with a higher link order can override this configuration when you restart the computer or run gpUpdate again. If your corporate standards do not allow you to modify the default domain controllers policy, create a GPO for your Change Guardian settings, add these settings to the GPO, and set it to have the highest link order in the Domain Controllers OU.
Expand Computer Configuration > Policies > Windows Settings > Security Settings.
Select Event Log and set:
Maximum security log size to 10240 KB (10 MB) or more
Retention method for security log to Overwrite events as needed
To update policy settings, run the gpUpdate command at the command prompt.
To verify the configuration is successful:
Open a command prompt as an administrator to the computer.
Start Event Viewer: eventvwr
Under Windows logs, right-click Security, and select Properties.
Ensure that the settings show maximum log size of 10240 KB (10 MB) or more and that Overwrite events as needed
is selected.
Configure AD auditing to enable logging of AD events in the security event log.
Configure Default Domain Controllers Policy GPO with Audit Directory service access to monitor both success and failure events.
To configure AD auditing:
Log in as an administrator to a computer in the domain that you want to configure.
To open Group Policy Management Console, run gpmc.msc at the command prompt.
Expand Forest > Domains > domainName > Domain Controllers.
Right-click Default Domain Controllers Policy, and click Edit.
NOTE:Changing the default domain controllers policy is important because a GPO linked to the domain controller (DC) organizational unit (OU) with a higher link order can override this configuration when you restart the computer or run gpUpdate again. If your corporate standards do not allow you to modify the default domain controllers policy, create a GPO for your Change Guardian settings, add these settings to the GPO, and set it to have the highest link order in the Domain Controllers OU.
Expand Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies.
To configure AD and Group Policy, under Account Management, and Policy Change, select the following for each subcategory: Configure the following audit events, Success, and Failure.
To configure only AD, under DS Access, select the following for each subcategory: Configure the following audit events, Success, and Failure.
Click Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options, enable Force audit policy subcategory setting on the default domain policy.
Under Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Audit Policy.
Under Audit account management, Audit directory service access, and Audit policy change, select the following for each subcategory: Define these policy settings, Success, and Failure.
To update policy settings, run the gpUpdate command at the command prompt.
For more information, see Monitoring Active Directory for Signs of Compromise in the Microsoft Documentation site.
Configure user and group auditing to audit the following activities:
Logon and logoff activities of local users and Active Directory users
Local user settings
Local group settings
To configure user and group auditing:
Log in as an administrator to a computer in the domain that you want to configure.
Open Microsoft Management Console, select File > Add/Remove Snap-in.
Select Group Policy Management Editor and click Add.
In the Select Group Policy Object window, click Browse.
Select Domain Controllers.FQDN, where FQDN is the Fully Qualified Domain Name for the domain controller computer.
Select Default Domain Controllers Policy.
In the Microsoft Management Console, expand Default Domain Controllers Policy FQDN > Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Audit Policy.
Under Audit Account Logon Events and Audit Logon Events, select Define these policy settings, Success, and Failure.
In the Microsoft Management Console, expand Default Domain Controllers Policy FQDN > Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Logon/Logoff.
Under Audit Logon, select Audit Logon, Success, and Failure.
Under Audit Logoff, select Audit Logoff, Success, and Failure.
To update policy settings, run the gpupdate /force command at the command prompt.
Security Access Control Lists (SACLs) describe the objects and operations to monitor.
To allow Change Guardian to monitor changes of current and future objects inside Active Directory, follow the steps in Configuring SACLs for AD. However, if you are using Change Guardian for only Group Policy in your environment, see Configuring SACLs for GPO.
To monitor all changes of current and future objects inside Active Directory, configure the domain node.
To configure SACLs:
Log in as an administrator to a computer in the domain that you want to configure.
To open ADSI Edit configuration tool, run adsiedit.msc at the command prompt.
Right-click ADSI Edit, and select Connect to.
In the Connection Settings window, specify the following:
Name as Default naming context.
Path to the domain to configure.
If you are performing this step for the first time, select Default naming context.
If you are performing for the second time, select Schema.
If you are performing for the third time, select Configuration.
In Connection Point, set Select a well known Naming Context to Default naming context.
In the ADSI Edit window, expand Default naming context.
Right-click the node under the connection point (begins with DC= or CN=), and click Properties.
On the Security tab, click Advanced > Auditing > Add.
In Applies to or Apply onto, select This object and all descendant objects.
Configure auditing to monitor every user:
Click Select a principal, and type everyone in Enter the object name to select.
Specify the following options:
Type as All
Select Permissions as:
Write All Properties
Delete
Modify Permissions
Modify Owner
Create All Child Objects
The other nodes related to child objects are selected automatically
Delete All Child Objects
The other nodes related to child objects are selected automatically
Deselect the option Apply these auditing entries to objects and/or containers within this container only.
LDAP (Lightweight Directory Access Protocol) is a directory service that you can use to authenticate, monitor and search for information of your Active Directory (AD). Directory services store the users, passwords, and computer accounts, and share that information with other entities on the network.
Active Directory uses the LDAP query to search and gather organized information about the entities. AD query monitoring requires you to perform the following steps:
You can enable Expensive and Inefficient LDAP calls to be logged in Event Viewer through the AD query auditing.
To configure AD query auditing:
Log in as an administrator to a computer in the domain that you want to configure.
In the Start menu, type regedit and open Registry the Editor.
Click HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > NTDS > Diagnostics.
Open 15 Field Engineering and set the value data to 5.
NOTE:Logging Event ID-1644 events might impact the server performance. For more information, see Event ID-1644. Microsoft recommends setting a desired threshold to troubleshoot LDAP queries.
To enable AD binding events to be logged, you can follow the steps:
Log in as an administrator to a computer in the domain that you want to configure.
In the Start menu, type regedit and open the Registry Editor.
Click HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > NTDS > Diagnostics.
Open 16 LDAP Interface Events and set the value data to 2.
To set the audit for LDAP connection, perform the following steps:
Log in as an administrator to a computer in the domain that you want to configure.
To open Group Policy Management Console, enter the following in the command prompt: gpmc.msc.
Open Forest > Domains > domainName> Domain Controllers.
Right-click Default Domain Controllers Policy, and then click Edit.
NOTE:Changing the default domain controllers policy is important because a GPO linked to the domain controller (DC) organizational unit (OU) with a higher link order can override this configuration when you restart the computer or run gpUpdate again. If your corporate standards do not allow you to modify the default domain controllers policy, create a GPO for your Change Guardian settings, add these settings to the GPO, and set it to have the highest link order in the Domain Controllers OU.
Expand Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Audit Policy.
Under Audit Account Management, and Audit Directory Service Access, select the following for each subcategory: Define these policy settings, Success, and Failure.
(Conditional) To link new GPO, navigate to Group Policy Management Console > Forest > Domains > domainName> Domain Controllers.
Right-click Default Domain Controllers Policy > click Link an existing GPO > select the newly created GPO.
To force the group policy update, right-click the defined OU and select Group Policy Update.
To update policy settings, run the gpUpdate command at the command prompt.
Open the Event Viewer using the command in the command prompt: eventvwr.exe and navigate to Applications and Service Logs > Directory Service > Properties. Ensure that settings for Maximum log size is 4000000 KB or (4 GB) and select Overwrite events as needed.
(Optional) To apply a specific set of permissions in the Active Directory that are supported by your organization, see Configuring Security Access Control Lists.
To update the audit in ADSI:
To open ADSI editor, use the command adsiedit.msc in the command prompt.
Right-click ADSI edit > Connect to Default Naming Context.
Right-click Domain DNS object with your domain name > Properties > Security > Advanced > Auditing > click Add to add Principal Everyone > specify Success in Type field > select Applies to field with This object and descendant objects > select all the check boxes except Full Control, List Contents, Read all properties, Read Permissions > select OK.
You can configure the LDAP signing in client and server.
To configure LDAP server (Domain Controller) singing:
Select Start > Run, type mmc.exe. Click OK.
Navigate to File > Add/Remove Snap-in> Group Policy Management Editor > click Add.
Select Group Policy Object > Browse.
In the Browse for a Group Policy Object dialog box, select Default Domain Controller Policy under the Domains, OUs, and linked Group Policy Objects area > click OK.
Click Finish > OK.
Select Default Domain Controller Policy > Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options.
Right-click Domain controller: LDAP server signing requirements > select Properties.
In the Domain controller: LDAP server signing requirements Properties dialog box, enable Define this policy setting and select Require signing in the Define this policy setting list > click OK.
In the Confirm Setting Change dialog box, select Yes.
To configure LDAP client signing (Network Security):
Select Start > Run, type mmc.exe > click OK.
Navigate to File > Add/Remove Snap-in> select Group Policy Object Editor > select Add. Click Finish. Click OK.
Select Local Computer Policy > Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies> Security Options.
Right-click Network security: LDAP client signing requirements > select Properties.
In the Network security: LDAP client signing requirements Properties dialog box, select Require signing from the list > click OK.
In the Confirm Setting Change dialog box, select Yes.
IMPORTANT:After configuring the LDAP signing, to update policy settings, run the gpUpdate command at the command prompt.
Change Guardian monitors the following in Federation Services (FS):
Application token success and failure
Fresh credential validation success and failure
Password change request success and failure
To configure Federation Service auditing:
Log in as an administrator in the domain that you want to configure.
Open Group Policy Management Console. Run gpmc.msc using command prompt.
Click Forest > Domains > Domain Name > Domain Controllers.
Right-click Default Domain Controllers Policy and select Edit.
NOTE:Changing the default domain controllers policy is important because a GPO linked to the domain controller (DC) organizational unit (OU) with a higher link order can override this configuration when you restart the computer or run gpUpdate again. If your corporate standards do not allow you to modify the default domain controllers policy, create a GPO for your Change Guardian settings, add these settings to the GPO, and set it to have the highest link order in the Domain Controllers OU.
Click Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies.
To configure ADFS auditing under Object Access, select the following for Audit Application Generated: Configure the following audit events, Success, and Failure.
To update policy settings, run the gpUpdate command at the command prompt
To configure Federation Service auditing:
To open the Federation Service Management snap-in click Start > Programs > Administrative Tools > AD FS Management.
In the Actions pane, click Edit Federation Service Properties.
In the Federation Service Properties dialog box, click Events.
Select the Success audits and Failure audits check boxes.
Click OK.
AD objects: Policies about creating and deleting a domain, modifying connection object, and so on
AD Query Policies about accessing, authorizing, and monitoring the Active Directory information
Computer accounts: Policies about disabling and moving a computer account, and changing permission to accounts
Configurations: Policies about creating and deleting GPOs
Contacts: Policies about creating, deleting, moving, and changing permission of contacts
DNS Configuration: Policies about modifying DNS configurations, and monitoring the node and zone
Federation Service: Policies about securely sharing digital identity and entitlements rights across security and enterprise boundaries
Groups: Policies about the following:
Creating distribution group and security group
Membership changes to distribution group, privilege group, and security group
Organization units: Policies about creating, deleting, moving, and changing permission of organization unit
Schema: Policies about the following:
Creating and changing schema attributes and classes
Deactivating and reactivating schema objects
Changing schema permissions
Changing schema settings
NOTE:If you want to receive all events related to Schema, create more than one policy having related Schema events as policy definition. For example, create a policy to monitor events about schema attribute created and schema attribute modified.
Trusts: Policies about creating, deleting, and modifying trust
User accounts: Policies about the following:
Changing administrator or guest accounts
Failure to reset user password
Disabling and moving user accounts
Changing permission to user accounts
For more information about creating policies, see Creating Policies.
After creating policies, you can assign them to agents. For information about assigning policies, see Assigning Policies or Policy Sets.
NOTE:If you assign the Active Directory schema policies created for Attribute and Class schema monitoring together, the AD schema events are not generated successfully. Create separate policies for Attribute and Class schema.