A critical part of securing the Active Directory environment is being able to obtain detailed insights on when objects are created.
Below are the steps it takes to generate a report for when objects are created in Active Directory using native processes:
In the Run window, type the command – gpmc.msc to open the Group Policy Management Console.
- Group Policy Audit Settings – Configuration
To edit the Group policy of a particular domain, simply select your domain, navigate to the “Default Domain Policy” and right click on it to select the “Edit” option.
- Editing the Default Domain Policy of the Domain
In the left panel, navigate to Computer Configuration → Windows Settings → Security Settings → Local Policies → Audit Policy and double-click ‘Audit account management’
- Define the Settings for Audit Account Management Policy
Next, click the Security Policy Setting tab and select ‘Success’ under the “Audit these attempts” checkbox.
- Selecting the Security Policy Setting Tab
Expand ADSI Edit and the default naming context. Next, right click on the particular domain name and select Properties.
- Configuration of ADSI
In the DC properties window, navigate to the security tab and click Advanced. In the Advanced Security Settings, navigate to the Auditing tab and click Add. In the field – Enter the object name, write ‘Everyone’ and in the Auditing Entry, select “Create all child objects” and finally click OK.
- Navigate to Auditing Entry Window for Your Domain
Open Event Viewer, expand Windows Logs and select Security. In the “Filter Security Event Log” window, select the duration, event level and fill up the other necessary details along with Event ID – 5137 to get details on when an object was created.
- Filtering the Security Event Log by Event ID 5137
To get more information on the event, Double-click on it to open the Event Properties Window.
- Generating Details of the Event
How LepideAuditor for Active Directory Helps to Track When an Object is Created in Active Directory
IT administrators must regularly audit events in user accounts and keep a constant track on the activities of users in order to stay informed about what’s happening in their AD environment. However, native auditing techniques make this quite an arduous and technically difficult process. Therefore, we recommend deploying auditing solutions, like Lepide Active Directory Auditor, that can enhance security by automatically tracking every single object in Active Directory.
Whenever a user creates an object, Lepide Active Directory audit solution provides all details about that particular object and sends through real-time alerts. These alerts are delivered as emails, as updates to LiveFeed widget and as push notifications to the LepideAuditor App (for Android and Apple devices).
Below is a screenshot that displays the Object Created Reports under the “Active Directory Modifications Report” tab of LepideAuditor for Active Directory.