topic Re: Audit who makes changes to Active Directory in Getting Data In

Audit who makes changes to Active Directory

dshipman — Thu, 15 Mar 2012 16:46:51 GMT

Hi,

I'm looking into using Splunk to report on Active Directory. I've installed the free edition on a test domain & set it up to monitor the directory schema. It seems to be picking up events but I'm unable to find any information about who makes changes (e.g. account create/delete) - is this possible at all?

Thanks in advance for any advice

Re: Audit who makes changes to Active Directory

MarioM — Sun, 18 Mar 2012 09:07:20 GMT

You should install and look at this app first :

windows-security-operations-center

Re: Audit who makes changes to Active Directory

xxmarkxx8 — Thu, 01 Jun 2017 11:18:22 GMT

Hi there,

I know this is an old thread but I am having the same issue as above.
I have installed the windows security operations center app but it doesn't display which user made the changes to an AD object. I have tested Netwrix and that application can find the user details with no problem (so I know it is not an auditing settings problem)
Any help would be much appreciated.

Regards,

Mark B