Can't find what you're looking for? Access our previous PDF-based library.
8 min read
️ Updated Jun 24, 20261. Adding an Active Directory Component
The following steps will take you through the steps to add an Active Directory, Group Policy and Exchange Server component to the solution.
NOTE: Before continuing, ensure that the Pre-requisites and requirements to audit the domain are met.
To add a component, from the Component Management window in the Lepide Main Console, click on the Active Directory icon:
A wizard will start with two configuration options available for adding a component. These are:
Express Configuration: Add with minimal recommended settings.
Advanced Configuration: Add with customizable advanced settings
1.1 Add a Component with Express Configuration
From the Configuration Type dialog box, select Express Configuration and click Next
This takes you to the Domain Credentials dialog box
1.1.1 Domain Credentials
In this section, you will provide details of the component to be added.
Domain Name or IP: Enter the domain name or its IP Address. Click to let the solution discover the current domain in which it is installed. This will auto-fill the domain name in the text box.
Username: Enter the username in the format Username@domain.com. Ensure that you provide the complete username with the domain name.
Password: Enter the correct password for the selected user.
Auditing Method
Without Agent: With this approach, there is no need to install agents on the Domain Controllers. The auditing will be done completely agentless by making real-time connections to the DCs. The least privilege configuration needs to use this approach as the agent can’t be installed with least privilege account.
NOTE: If you are configuring with least privileges. please select Without Agent.
With Agent: With Agent approach is recommended in the following scenarios:
When the domain controllers are placed in different geographical locations which have slow network connections.
When the event log retention size is smaller than 1 GB on the DCs.
Click Next once you have provided all the details for the Domain Credentials dialog box.
If native auditing is not enabled at the domain level by default, the following dialog box appears:
The user account will need at least Schema Admin permission to enable the auditing automatically. You can temporarily elevate the permissions of the user account to Schema Admins and then click Yes, to enable the auditing automatically.
Or you can click No, if you wish to do it later manually with the help of our Advanced Configuration guide.
Click Yes, Software can make required changes (only if the permission of the user account is elevated to Schema Admins)
The following dialog box will be displayed:
Server Name or IP: Enter either the IP Address of the primary domain controller or the name of the domain.
Then select any of the following options:
Create New GPO (Recommended):
Select this to create a new Group Policy Object. Once selected, you need to provide the name of new Group Policy to be created.
Click OK to create a new Group Policy at the domain to enable the auditing.
Select GPO:
This option lets you select a Group Policy Object to enable auditing. Select this option to enable the adjoining section.
Perform the following steps to select an existing Group Policy.
If a Group Policy is not listed here, you can click to rescan the domain for an updated set of Group Policies.
You cannot select Default Domain Controller Group Policy or Default Domain Group Policy to enable the auditing using Lepide Data Security Platform. If you try to do this, the following error message appears on the screen:
Select a custom Group Policy created at the Domain Level or Domain Controller Level upon which the auditing setting must be applied.
Make sure to check the Create a backup of selected Group Policy Object before enable auditing box if you are enabling the auditing on an existing Group Policy. This backup allows you to restore the previous default Domain Controller Policy if any issue persists after enabling the auditing.
To avoid such an issue, create a new Domain Controller Policy to enable the auditing.
Click OK. The software tries to enable the auditing and create the backup of the selected group policy on the server in the %systemdrive%\Windows\Lepide\GPOBKP_24-01-2017 18_13_35\ folder.
Here, 24-01-2017 will be replaced with the date and 18_13_35 will be replaced with the time when you have clicked OK to enable auditing on the selected policy.
If you face any issue in future, you can use this backup to restore the policy to an earlier state.
Refer to the Advanced Configuration Guide to restore the group policy.
You will need to wait a short time until the auditing is enabled.
If there is a problem enabling the audit, you may receive the following or another error message:
In the case of the above error or a different problem, you will have to enable the auditing settings manually on the Windows Server.
In this case, please select No from the next dialog box and proceed further.
Please refer to the Advanced Configuration Guide for information on enabling the auditing settings manually.
Once auditing is enabled, the solution displays the next step to configure the auditing.
1.2 Advanced Domain Configuration
All domain controllers in the domain will be listed here. You can select which modules are required:
1.3 Enable Auditing
Check or uncheck the following options to enable or disable auditing, backup snapshots and Health Monitoring.
Audit Active Directory: Enable/disable the Auditing of Active Directory.
Audit Group Policy: Enable/disable the Auditing of Group Policy Objects.
Audit Exchange Server: Enable/disable the Auditing of Exchange Server.
Non-owner Mailbox Auditing: Enable/disable the mailbox access auditing of non-owner users and owners.
Health Monitoring: Enable/disable the Health Monitoring of Active Directory and Exchange Servers.
Active Directory Backup: Enable/disable the backup snapshot feature to create snapshots of Active Directory.
Group Policy Backup: Enable/disable the backup snapshot feature to create snapshots of Group Policy Objects.
To configure these components, please refer to the Advanced Configuration Guide.
Click Next to continue.
1.4 IP Settings
Please verify the IP Addresses resolved by the solution in this wizard.
If the field is blank or IP Address is wrong, double click the cell containing IP Address to make this field editable. Enter the correct IP Address and press the ENTER key.
You can click icon to restore the default options for this step.
You can also select the preferred domain controller, to which the calls related to backup snapshots will be sent.
NOTE: The selected domain controller should be located nearby to the application server, so that the actions related to these calls can be performed first. You can also select a domain controller which is comparatively idle or has lesser load.
If there is a long list of domain controllers, then you can use the top filtration row to filter for the required domain controllers that have to be modified.
The following image shows an example:
When finished click Next to continue.
1.5 Database Settings
In this step, you need to provide the details of SQL Server and database that will be used to store the audit data. The solution lets you connect both to a locally hosted or a networked SQL Server.
Enter the SQL Server name manually or click the
NOTE: Click the
Provide the SQL Server username and password to allow the solution to access SQL using these credentials.
NOTE: Here, the selected user should have dbcreator role in SQL Server.
Provide the database name where the Lepide Data Security Platform will store the auditing logs.
NOTE: Lepide Data Security Platform connects to a database created by the solution itself. The solution alerts when you try to use an existing database.
If you are using the solution for the first time, you can provide a name for the new database that will be created with the solution. In the case of reinstallation, you can use a database created earlier by the solution.
You must test the connection between the solution and the selected SQL Server. This helps to authenticate the database connection.
Click Test Connection.
It displays either an error if failed to connect or the following message confirming the successful connection.
NOTE: Click
Click Finish to add the domain with the above settings.
A message box to restart the solution appears on the screen:
