How to Enable Active Directory Auditing: Step-by-Step Guide

How to Enable Active Directory Auditing Using Group Policy

Step 1: Create or Edit a GPO for Domain Controllers

Follow these steps to create and link a GPO for Active Directory auditing:

1. Open Server Manager → Tools → Group Policy Management.
2. Expand Forest → Domains → Your Domain.
3. Locate the Domain Controllers OU.
4. Right-click the Domain Controllers OU and select Create a GPO in this domain, and Link it here.
5. Give the GPO a descriptive name, such as Active Directory Audit Policy.
6. Right-click the GPO and select Edit.

You can also use an existing GPO that applies to your domain controllers. Using a dedicated GPO, however, can make the auditing configuration easier to identify and manage.

Step 2: Configure the Required Advanced Audit Policies

In the Group Policy Management Editor, navigate to:

Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies

Configure the audit subcategories required for the activities you want to monitor.

Account Logon

Under Account Logon, relevant subcategories include:

• Audit Credential Validation
• Audit Kerberos Authentication Service
• Audit Kerberos Service Ticket Operations

These subcategories can be used to audit domain authentication and credential-validation activity.

Account Management

Under Account Management, relevant subcategories include:

• • Audit User Account Management – records user account creation, deletion, modification, password changes and resets, lockouts, and related activities.
  • Audit Security Group Management – records security group and group membership changes.
  • Audit Computer Account Management – records computer account creation, modification, and deletion.

DS Access

Under DS Access, relevant subcategories include:

• Audit Directory Service Changes – records changes to Active Directory objects. Enable Success auditing when you need to track object changes.
  
• Audit Directory Service Access – records access to AD objects when the activity matches auditing entries configured on those objects.

Directory Service Changes auditing can generate events such as:

• 5136 – A directory service object was modified
• 5137 – A directory service object was created
• 5138 – A directory service object was undeleted
• 5139 – A directory service object was moved
• 5141 – A directory service object was deleted

Directory Service Access auditing can generate Event ID 4662 and may produce a large volume of events, so enable it only when required.

Logon/Logoff

Under Logon/Logoff, configure the required subcategories, such as Audit Logon, according to the activities you need to monitor.

Audit Logon can generate:

• 4624 – An account was successfully logged on
• 4625 – An account failed to log on

To configure any required audit subcategory:

1. Double-click the subcategory.
2. Select Configure the following audit events.
3. Enable Success, Failure, or both according to your monitoring requirements.
4. Click Apply → OK.

Do not enable Success and Failure for every available audit subcategory by default. Configure only the auditing required for the activities you need to monitor.

Step 3: Configure Object-Level Auditing

For detailed auditing of changes to specific Active Directory objects, appropriate auditing entries may also need to be configured on the objects or containers you want to monitor. These auditing entries are stored in the object’s System Access Control List (SACL).

To configure object-level auditing:

1. Open Active Directory Users and Computers.
2. Select View → Advanced Features.
3. Locate the object or Organizational Unit (OU) that you want to audit.
4. Right-click it and select Properties.
5. Select Security → Advanced → Auditing.
6. Click Add, and then click Select a principal.
7. Select the user or group whose activity you want to audit.
8. Select the appropriate audit type, scope, and permissions.
9. Click OK to save the auditing entry.

Avoid auditing every permission unless required, as broad object-level auditing can generate a large number of Security events.

Note: Enabling Audit Directory Service Changes alone does not necessarily generate detailed change events for every AD object. The appropriate SACL must be configured, and the activity must match the auditing entry.

Step 4: Configure the Advanced Audit Policy Override

Windows includes both basic category-level audit policies and the more granular Advanced Audit Policy subcategories. To prevent the basic audit policy settings from overriding the Advanced Audit Policy settings configured above, enable the audit policy override setting.

In the same GPO, navigate to:

Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → Security Options

Locate:

Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings

Then:

1. Double-click the policy.
2. Select Define this policy setting.
3. Select Enabled.
4. Click Apply → OK.

This helps prevent legacy category-level audit settings from overriding the Advanced Audit Policy subcategories.

Step 5: Apply the Group Policy

After configuring the required audit settings, allow Group Policy to refresh normally or force an update for testing.

Open Command Prompt as an administrator on a domain controller and run:

gpupdate /force

Wait for Group Policy processing to complete.

Step 6: Verify That Active Directory Auditing Is Enabled

After applying the GPO, verify the effective audit policy configuration on a domain controller.

Open Command Prompt as an administrator and run:

auditpol.exe /get /category:*

This displays the effective audit policy configuration.

To check a specific subcategory, such as Directory Service Changes, run:

auditpol.exe /get /subcategory:"Directory Service Changes"

Confirm that the subcategory shows the expected auditing setting, such as:
Directory Service Changes Success

If the expected setting does not appear, verify that the GPO is linked to the correct OU and has been successfully applied to the domain controller.

Where Are Active Directory Audit Logs Stored?

After auditing is enabled, relevant events are recorded in the Security logs on domain controllers.

To access them, open:

Event Viewer → Windows Logs → Security

You can filter the Security log using the Event IDs associated with the activities you need to investigate.

For detailed instructions on finding and interpreting these events, see How to Track Changes in Active Directory.

Limitations of Native Active Directory Auditing

Native Active Directory auditing provides detailed information about security activity, but it has some limitations:

• Manual configuration: Audit policies and object-level auditing must be configured correctly.
• High event volume: Broad auditing can generate a large number of Security events.
• Distributed logs: Events may be stored across multiple domain controllers.
• Manual analysis: Administrators may need to filter and correlate multiple events during investigations.
• Retention depends on configuration: Security log size and retention settings determine how long events remain available.
• Limited reporting and alerting: Centralized reporting and real-time alerting require additional configuration or tools.

How Lepide Helps with Active Directory Auditing

Lepide’s Active Directory auditing solution has many features to help you track and monitor changes being made to your Active Directory environment. It can audit following activities:

• Object creation, deletion and modifications
• Permission changes
• Security Settings
• Privileged User activities
• Track and Troubleshoot Account Lockouts
• Failed and Successful Logon/Logoff activities
• and more…

Lepide gives you complete visibility over the risks to your Active Directory security so that you can address potential vulnerabilities.

With pre-defined, compliance-ready reports, real time alerts and advanced anomaly spotting, you can identify unwanted or unauthorized changes to configurations and permissions. You can also generate real time threat response models to remediate the threats, fast.

Lepide Active Directory auditing solution allows you to simplify access rights by showing you who has privileged access and how they got it. You can also monitor often exploited attack paths by keeping track of logon/logoff activity, password resets, account lockouts and more.

Frequently Asked Questions