AD user groups

lucasjeff — Thu, 17 Apr 2014 20:15:02 GMT

I am looking to monitor specific AD user groups and want to create a search that alerts me to when the members of these groups change.

How do I pull that information?

Re: AD user groups

JeremyHagan — Mon, 28 Sep 2020 16:49:30 GMT

You need to collect the Windows Security Event logs from you domain controllers, then you need to create an alert based on a search similar to this:
(EventCode=4732 OR EventCode=4728 OR EventCode=4756) (Group_Name="Domain Admins" OR Group_Name="Enterprise Admins" OR Group_Name="Schema Admins")

Re: AD user groups

brooklynotss — Tue, 11 Aug 2015 16:57:59 GMT

Or a little more robust, create a lookup csv file with the list of groups you care about, your "privileged groups" if you will and refer to it in your search like so:

index=wineventlog tag::host="domaincontroller" eventtype=msad-nt6-groupmembership-changes  NOT "[domainname]\\[serviceaccountthatmakeslotsofchanges]" | eval AdminAccount=upper(replace(mvindex(Security_ID,0), "[domainname]\\\\", "")) | eval ChangedAccount=upper(replace(mvindex(Security_ID,1), "[domainname]\\\\", "")) | eval GroupName=replace(mvindex(Security_ID,2), "[domainname]\\\\", "") | fields _time, host, AdminAccount, ChangedAccount, GroupName, name | search [|inputlookup PriviledgedGroups | fields GroupName] | table _time, host, AdminAccount, ChangedAccount, GroupName, name | rename name as "Action" | sort - _time

Explanation:
We've tagged all our Domaincontrollers
We have only one domain and have both ldap and windows infrastructure app installed so i'm piggy backing off one of those eventtypes.
I'm excluding a service account that makes tons of automated changes we don't care about alerting on.
Then grabbing the account that did the action and the account the action was taken upon, cleaning up the text (removing the domain\ portion since we have only one domain).

Then set schedule and alert parameters as needed. Results in an email like shown in the attached file

topic Re: AD user groups in Getting Data In

AD user groups

Re: AD user groups

Re: AD user groups