Auditing for helpdesk

  • Thread starter Thread starter SA
  • Start date Start date
S

SA

Hi all,
I was wondering where I could see an audit trail for custom MMC's that I
have created for my helpdesk users to reset passwords and manage users.

In the DC event logs perhaps?

SA.
 
SA said:
Hi all,
I was wondering where I could see an audit trail for custom MMC's that I
have created for my helpdesk users to reset passwords and manage users.

In the DC event logs perhaps?
Click to expand...

Custom MMC's aren't really something auditable.

The USE of the MMC to change AD is however.

Audit either the GENERAL "Account Management"
of use "DS Object auditing" AND set the auditing
(ACLs) on the objects in AD.
 
Hit help on a server and search for Auditing.

Go to the Domain Controller GPO and make a GPO
(make you own and don't use the Default so you can
keep the changes separate).

Go to Computer\Windows\Security\Local\Audit policy

Turn on "Account Management" -- wait for refresh and
then go edit something in Users and Computer and then
check your Security Event Log.

See if that is sufficient -- DS auditing is not for the faint
of heart and requires more careful planning and a bit
of study (read TechNet or hit help a lot.)
 
Back
Top