Auditing Active Directory: audit policy, key events and forwarding

Skills you'll practise

• Configure advanced audit policy through Group Policy and explain why basic and advanced settings shouldn't be mixed
• Explain why Directory Service Changes events need both the audit subcategory and SACLs on the objects
• Identify the event IDs for account, group-membership, sign-in, lockout, audit-policy and directory changes
• Choose what to collect and where to forward it so events survive log rollover
• Investigate a privileged group change from the events and write up who changed what and when

Course outline

1. 1.Audit policy: basic, advanced and the force settingLesson · 15 min
2. 2.Directory changes, SACLs and the events that matterLesson · 18 min
3. 3.Keeping events: log size, forwarding and reviewsLesson · 15 min
4. 4.Auditing Active Directory: audit policy, key events and forwarding: knowledge checkKnowledge check · 14 questions
5. 5.Auditing Active Directory: audit policy, key events and forwarding: practical exerciseKnowledge check · 1 question
6. 6.Final exam10 questions · passing it completes the course, so people who already know the material can test out

Sources it draws on

The lessons and questions are written from these references, so learners can go back to the original.

• Microsoft Learn: Advanced security audit policy settings
• Microsoft Learn: Advanced Security Auditing FAQ
• Microsoft Learn: Security auditing settings are not applied when you deploy a domain-based policy
• Microsoft Learn: Audit Directory Service Changes
• Microsoft Learn: Appendix L: Events to monitor
• Microsoft Learn: 4740(S) A user account was locked out
• Microsoft Learn: Use Windows Event Forwarding to help with intrusion detection
• Microsoft Learn: Implementing least-privilege administrative models