JSI Tip 5013. How do I audit access to the Active Directory?

When you audit authorized and unauthorized access to the Active Directory, the Directory Service Event log on a domain controller records the events.

To enable auditing:

1. Administrative Tools / Active Directory Users and Computers.

2. Highlight the domain name and enable Advances Features on the View menu.

3. Right-click the Domain Controllers container and press Properties.

4. Select the Group Policy tab.

5. Select the Default Domain Controller Policy and press the Edit button.

6. Navigate to Computer Configuration / Windows Settings / Security Settings / Local Policies / Audit Policy.

7. Double-click Audit directory service access.

8. Check the Success and Failure boxes.

9. Press OK and OK, closing the snap-in.

NOTE: The default timing for application of this policy is 5 minutes. See Windows 2000 Group Policy refresh. Don't forget replication timing to the other domain controllers.

Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.