1. Introduction

Welcome to the Enable Auditing Manually guide created for Lepide Data Security Platform. This solution provides a comprehensive means of auditing Active Directory, Group Policy, Exchange Server, SharePoint, SQL Server, and File Server.

This guide helps you to enable domain auditing manually. If you have any questions at any point in the process, you can contact our Support Team. The contact details are mentioned at the end of this document.

2. Enable Auditing Automatically

While adding a domain, after you provide the appropriate details, the Lepide Data Security Platform shows the following dialog box to enable auditing at the domain level automatically.

While modifying the properties of an already added domain, the Enable Audit option appears for Domain Credentials property.

You can click   button. It displays the following dialog box.

Enter either IP Address of the primary domain controller or name of the domain. Select any of the following options.

• Create New Policy (Recommended): Select it to create a new Domain Controller Policy. Once selected, you have to provide the name of new Group Policy to be created.

Click OK to create a new Group Policy at the domain to enable the auditing.

• Use Selected Domain Controller Policy: This option lets you select a policy to enable the auditing.

Select this option to enable its section. Perform the following steps to select an existing Group Policy.

• If a Group Policy is not listed here, you can click the  icon to rescan the domain for listing the updated set of Group Policies.

• You cannot select Default Domain Controller Group Policy or Default Domain Group Policy to enable the auditing using Lepide Data Security Platform. If you try, the following error message appears on the screen.

• Select a custom Group Policy created at the Domain Level or Domain Controller Level upon which the auditing setting has to be applied.

• Make sure to check Create backup of selected GPO before enable auditing box if you are enabling the auditing on an existing Group Policy. This backup allows you to restore the previous default Domain Controller Policy if any issue persists after enabling the auditing.
  
  It is recommended to create a new Domain Controller Policy to enable the auditing to avoid any such issue.

• Click OK. The software tries to enable the auditing and create the backup of the selected group policy on the server in "%systemdrive%\Windows\Lepide\GPOBKP_24-01-2017 18_13_35\" folder. Here, 24-01-2017 will be replaced with the date and 18_13_35 will be replaced with the time when you have clicked OK to enable auditing on the selected policy. 

If you face any issue in future, you can use this backup to restore the policy to the earlier state. Refer to Section 5 of this document restore the group policy.

• Wait until the auditing is enabled. 

3. Issue

If Lepide Data Security Platform faces any problem in enabling the auditing, it displays the following error message while adding/modifying the domain.

In such cases, you have to enable the auditing settings manually on the Windows Server.

4. Solution

Auditing settings of the Active Directory environment could be set up as follows:

If Lepide Data Security Platform displays any error message or does not enable the auditing, then you have to enable the auditing manually in the domain in both Group Policy Management Console and ADSIEdit Console. The steps to be performed in both consoles are listed below.

4.1 Enable Auditing using Group Policy Objects

You have to enable the local and advanced auditing policies in the Group Policy Management Console.

4.1.1 Enable Local Audit Policies

Follow the steps below to configure the Audit Polices for Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2 and Windows Server 2016.

• Go to Start Menu 🡪 All Programs 🡪 Administrative Tools 🡪 Group Policy Management. It opens Group Policy Management."

• In the left panel of Group Policy Management Console, navigate to "Forest: domain.com 🡪 Domains 🡪 domain_controller.com 🡪 Domain Controllers.

• Select an already existing customized policy in Domain Controllers folder, which is active and enabled on the domain controller organizational unit.

• If an existing custom policy does not exist, right-click on Domain Controllers node.

• Click Create a GPO in this domain, and Link it here..." to create a new Custom Group Policy. This command also links the newly created Group Policy to the domain controller’s node.

• The following dialog box appears on the screen, in which you have to provide the name of new policy.

• Enter the name of new Group Policy. Keep none selecting in Source Starter GPO.

• Click OK to create the new Group Policy Object. It takes you back to Group Policy Management Console, which now shows the newly created Group Policy in the left panel under Domain Controllers node.

• Right-click newly created Group Policy to access the following context menu.

• Click Edit to access Group Policy Management Editor for the selected policy.

• Browse to Computer Configuration 🡪 Policies 🡪 Windows Settings 🡪 Security Settings 🡪 Local Policies 🡪 Audit Policy. It displays the policies in the Right Panel. 

• Here, you have to configure the following policies for both successful and failed events.

  • Audit account logon events

  • Audit Account Management

  • Audit directory service access

  • Audit Logon Events

  • Audit Policy Change

• Double-click Audit account logon events policy to access its properties.

• Check the Define these policy settings box. It enables the subsequent section.

• Check both Success and Failure boxes under Audit these attempts.

• Click Apply and OK. It takes you back to Group Policy Management Editor, which now shows the configured policy.

• Follow the same steps to configure the following policies.

  • Audit Account Management

  • Audit directory service access

  • Audit Logon Events

  • Audit Policy Change

4.1.2 Enable Advanced Audit Policies

There are two different methods for Windows Servers to enable the advanced auditing policies in Group Policy Management Console. You have to run the commands on Command Prompt for Windows Server 2008, whereas you have to use Group Policy Management Console for Windows 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Sever 2016. 

Steps to Enable Advanced Audit Policies in Windows Server 2008 Only

Start the Command Prompt using Administrator privileges and execute the following commands one by one.

• Auditpol /set /category:Account Logon /success:enable /failure:enable

• Auditpol /set /category:Account Management /success:enable /failure:enable

• Auditpol /set /category:DS Access /success:enable /failure:enable

• Auditpol /set /category:Logon/Logoff /success:enable /failure:enable

• Auditpol /set /category:Object Access /success:enable /failure:enable

• Auditpol /set /category:Policy Change /success:enable /failure:enable

Steps to Enable Advanced Audit Policies in Windows Server 2008 R2 and above versions

You must perform the following steps to enable the Advanced Auditing Policies in the same customized Group Policy Object, in which you have enabled the Local Auditing Policies in the previous steps.

• In the left panel of Group Policy Management Editor, navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies. It displays the different policy categories in the Right Panel. 

• You have to configure all policies of the following categories.

  • Account Logon

    • Audit Credential Validation

    • Audit Kerberos Authentication Service

    • Audit Kerberos Service Ticket Operations

    • Audit Other Account Logon Events

  • Account Management

    • Audit Application Group Management

    • Audit Computer Account Management

    • Audit Distribution Group Management

    • Audit Other Account Management Events

    • Audit Security Group Management

    • Audit User Account Management

  • DS Access

    • Audit Detailed Directory Service Replication

    • Audit Directory Service Access

    • Audit Directory Service Changes

    • Audit Directory Service Replication

  • Logon/Logoff

    • Audit Account Lockout

    • Audit IPsec Extended Mode

    • Audit IPsec Main Mode

    • Audit IPsec Quick Mode

    • Audit Logoff

    • Audit Logon

    • Audit Network Policy Server

    • Audit Other Logon/Logoff Events

    • Audit Special Logon

  • Object Access

    • Audit Application Generated

    • Audit Certification Services

  • Audit Detailed File Share

    • Audit File Share

    • Audit File System

    • Audit Filtering Platform Connection

    • Audit Filtering Platform Packet Drop

    • Audit Handle Manipulation

    • Audit Kernel Object

    • Audit Other Object Access Events

    • Audit Registry

    • Audit SAM

  • Policy Change

    • Audit Audit Policy Change

    • Audit Authentication Policy Change

    • Audit Authorization Policy Change

    • Audit Filtering Platform Policy Change

    • Audit MPSSVC Rule-Level Policy Change

    • Audit Other Policy Change Events

• Execute the following steps to configure the above policies in the above listed different categories.

  • Click Account Logon category in the left panel to list all of its policies.

• In the Right Panel, double-click any policy say Audit Credential Validation to access its properties.

• Check Configure the following audit events box. It enables the subsequent section.

  • Check both Success and Failure boxes.

  • Click Apply and OK. It takes you back to Group Policy Management Editor, which now shows the configured policy.

  • Execute the above steps to configure other policies of Account Logon category.

• Follow the same steps to configure all policies in the above-listed categories.

• Close the Group Policy Management Editor. It takes you back to Group Policy Management Console.

• Select the newly created Group Policy to view its details the right panel.

• In Right Panel, the Security Filtering section lets you select the objects like users, groups and computers on which this policy will be applied.

• Click Add to display the box to add the objects upon which this policy will be applicable.

• Type Everyone in the text box as adding everyone means this Group Policy will be applicable on all Active Directory Objects.

Click Check Names. It verifies the provided entry and formats it as a link.

• Click OK to add it. It takes you back to Group Policy Management Console, which now shows Everyone has been added to the selected custom Group Policy.

• Close Group Policy Management Console.

• In Run box or at Command Prompt, execute the following command to update the Group Policy on all domain controllers.

gpupdate /force

4.2 Enable Auditing using ADSIEdit.msc

Perform the following audit settings using the ADSIEdit.msc on any Windows Server. Visit http://technet.microsoft.com/en-us/library/cc773354(v=ws.10).aspx to know more about installing and using ADSIEdit.msc.

You have to perform the following steps for all Windows Server.

• Open ADSIEdit.msc using the Run dialog box. You can also open it from Start Menu 🡪 Administrative Tools 🡪 ADSIEdit”.

• Connect to the Active Directory. Select any node and perform below steps. Repeat these steps for each root node.

• Right-click on the root ADSI Edit and select Connect to.

• It is required to connect to the following three naming contexts and to turn on their auditing.

  • Default Naming Context

  • Configuration

  • Schema

• Select Default Naming Context.

• Click OK to establish the connection. Default Naming Context will be connected and its root node will be displayed in Left Panel.

• Expand the root node to access the domain controller’s node – DC=www,DC=domain,DC=com.

• Again, right click on ADSIEdit parent node and select Connect To.

• In Connection Settings box, select Configuration for naming context and click OK.

1. It connects ADSI Edit to the Domain Configuration and displays its root node in the Left Panel.

2. Expand the node to access CN=Configuration,DC=www,DC=domain,DC=com.

3. Right click on ADSI Edit parent node and select Connect To.

4. Select Schema as the naming context and click OK to connect to it.

• It connects ADSI Edit to the Schema and displays its root node in the Left Panel.

• Expand its node to access CN=Schema,CN=”Configuration,DC=www,DC=domain,DC=com.

• Now, it is required to enable the auditing settings for the following four root nodes of different naming contexts.

  • DC=www,DC=domain,DC=com

  • CN=Configuration,DC=www,DC=domain,DC=com

  • CN=Schema,CN=Configuration,DC=www,DC=domain,DC=com

• The user has to perform the following steps one by one for each of the above nodes.

• Right click on DC=www,DC=domain,DC=com under Default Naming Context.

Figure 24: Right click on root node of Default Naming Context

1. Select Properties option to access its properties.

2. Switch to Security tab.

• Click Advanced button to access the Advanced Security settings.

• Switch to Auditing tab in Advanced Security Settings.

1. Click Add to add Everyone for auditing using the following box:

• Type Everyone to audit the changes made by all objects.

• Click Check Names to verify the username.

• Click OK to add the user. It shows Auditing Entry dialog box.

• Select This object and all descendant objects in Apply onto drop-down menu.

• Click Full Control in Successful column first.

• Now, you have to uncheck the following entries in Successful column.

  • Full Control

  • List contents

  • Read all properties

  • Read permissions

Keep other entries checked in Successful column.

• Make sure all checkboxes in Failed column are blank or not checked.

• Keep Apply these auditing entries to objects and/or containers within this container only unchecked.

• Click OK to apply the auditing entries. It takes you back to Auditing tab of Advanced Security Settings.

• Click Apply and OK to apply the auditing settings.

• Close Properties.

• Repeat the steps (a) to (q) of Step 17 to enable the auditing of remaining root nodes.

  1. CN=Configuration,DC=www,DC=domain,DC=com

  2. CN=Schema,CN=Configuration,DC=www,DC=domain,DC=com

• Close the window of ADSIEdit.msc.

5. Restore Backed up Group Policy

While enabling the auditing, Lepide Data Security Platform lets you select an existing Group Policy or create a new one. If you are selecting an existing Group Policy, the solution allows you to take its backup. The backup is created on the server in "%systemdrive%\Windows\Lepide\GPOBKP_24-01-2017 18_13_35\" folder. Here, 24-01-2017 will be replaced with the date and 18_13_35 will be replaced with the time when you have clicked OK to enable auditing on the selected policy. 
You can perform the following steps to restore the Group Policy using this backup to restore to its earlier state before enabling the auditing.

1. Go to Start → Administrative Tools → Group Policy Management Console to access its console.

2. In the left panel of Group Policy Management Console, browse to Forest → www.domain.com.

3. Right click on Group Policy Objects node and click Manage Backups option.

1. Manage Backups dialog box appears on the screen.

• Click Browse and open "%systemdrive%\Windows\Lepide" folder.

• Now select GPOBKP_*" folder of that date and time when you have selected to create the backup while enabling the auditing.

• Click "OK. It takes you back to Manage Backups dialog box that shows the Group Policy from the selected backup.

• You can click Restore to restore this backup.