Who made a change to a domain acounts privileges?

-

hi

a domain account sabotaged in environment , have been tasked to discover did it.

i have 60 dc's in geographically dispersed private cloud running win2k3. admins granted high level of trust pretty much all of them have domain admin rights.

it appears high level admin rights has modified users group memberships.

i have attempted search through logs on 1 of dc's without success.

thousands of security logs , search users name returns nothing.

it perfect if there tool similar lockoutstatus.exe

i have tried using eventcombmt, after long search no useful information returned (i don’t know how use it)

 

any appreciated

doug

hi

a domain account sabotaged in environment , have been tasked to discover did it.

i have 60 dc's in geographically dispersed private cloud running win2k3. admins granted high level of trust pretty much all of them have domain admin rights.

it appears high level admin rights has modified users group memberships.

i have attempted search through logs on 1 of dc's without success.

thousands of security logs , search users name returns nothing.

it perfect if there tool similar lockoutstatus.exe

i have tried using eventcombmt, after long search no useful information returned (i don’t know how use it)

 

you can find out when/where/what time using repadmin /showobjmeta, can found if auditing enabled prior change taken place. using repadmin /showobjmeta shows on dc changes has been made, can search dc's logs changes, else i'm not aware there method find out w/o dc's security logs.

http://blogs.technet.com/b/askpfeplat/archive/2012/03/05/how-to-track-the-who-what-when-and-where-of-active-directory-attribute-changes-part-i-the-case-of-the-mysteriously-modified-upn.aspx

http://blogs.msdn.com/b/dsadsi/archive/2009/10/02/can-we-know-who-has-changed-an-attribute-in-active-directory.aspx

awinish vishwakarma - mvp

my blog: awinish.wordpress.com

disclaimer posting provided as-is no warranties/guarantees , confers no rights.



Windows Server  >  Directory Services



Comments

Post a Comment

Popular posts from this blog

Azure MFA with Azure AD and RDS

-
i have setup following lab in azure , need help. a server (domain controller) , remote desktop services. and server multi factor authentication server. i have setup following one http://www.rdsgurus.com/uncategorized/step-by-step-using-windows-server-2012-r2-rd-gateway-with-azure-multifactor-authentication/ and when im connecting got following error. the user "domain\username", on client computer "xxx.xxx.xxx.xxx", did not meet connection authorization policy requirements , therefore not authorized access rd gateway server. authentication method used was: "ntlm" , connection protocol used: "rpc-http". following error occurred: "23003". also on security log i've got following authentication details: connection request policy name: ts gateway authorization policy network policy name: - authentication provider: radius proxy authentication server: test.test.local authenticati...
Read more

Failed to setup initiator portal. Error status is given in the dump data.

-
hi team, server configured boot san  after booting  facing issue windows server 2008 r2 system logs continuously generating iscsi port error event id 5 failed setup initiator portal. error status given in dump data. eventdata \device\raidport1 000004000100000000000000050000c0000000000000000000000000000000000000000000000000070200c0 binary data: in words 0000: 00040000 00000001 00000000 c0000005 0008: 00000000 00000000 00000000 00000000 0010: 00000000 00000000 c0000207 in bytes 0000: 00 00 04 00 01 00 00 00 ........ 0008: 00 00 00 00 05 00 00 c0 .......À 0010: 00 00 00 00 00 00 00 00 ........ 0018: 00 00 00 00 00 00 00 00 ........ 0020: 00 00 00 00 00 00 00 00 ........ 0028: 07 02 00 c0 ...À hi, please read through article below troubleshoot issue: error event id 5 logged in system log on computer uses iscsi software initiator connect iscsi target device http://suppo...
Read more

Invalid pointer on gpresult /h gpreport.html

-
hello guys i getting following error when trying generate gpresult /h  xxx.html invalid pointer this happening on windows 7 pc using test group policy. tried pc same thing when same gpo applied . hi, try apply some other gpo clients, html report generated succefully? if no, may caused unregistered .dll files, try register .dll files previous thread suggested: http://social.technet.microsoft.com/forums/en-us/winservergp/thread/0ea20c5d-c0ae-457d-89d4-a1686a359e72 if yes, please tell detailed information problematic gpo settings reproduce problem , troubleshooting it. regards, cicely Windows Server  >  Group Policy
Read more