Auditing for account or group creation priviledge

  • Thread starter Thread starter Sgupta
  • Start date Start date
S

Sgupta

How can a user or group access privilege escalation for account or group
creation can be audited and reported with the Windows 2003 active directory.

Even with all auditing enabled It only shows event id 566 as the only
significant event with little info as below. It doesn't display the user or
group being granted acccess for and/or access to

Accesses: WRITE_DAC

Properties:
WRITE_DAC
domainDNS
 
Back
Top