Finding out who made changes in AD

how find out made changes global group in ad. windows 2008 r2.

hi,

you have enable auditing (http://support.microsoft.com/kb/232714). can find event log entry id 4757(removed) or 4756 (added) - universal groups - information in security event log. global groups event id 4729 (removed) , 4728 (added).

e.g.

"

member removed security-enabled universal group.

subject:
security id: frontoso\admlmh
account name: admlmh
account domain: frontoso
logon id: 0x2ea1a

member:
security id: frontoso\fholz
account name: cn=florian,ou=admins,ou=cl5000,dc=frontoso,dc=com

group:
security id: frontoso\rdg
group name: rdg
group domain: frontoso

additional information:
privileges: -

"

if have multiple dcs should think setting event collection service, events forwarded single server (http://technet.microsoft.com/en-us/library/cc774957(v=ws.10).aspx).

hth,

lutz

Windows Server  >  Security