Share via

Active Directory: How to Detect Who Added a User to Domain Admins Group

Why It is Important

Adding a user to the Domain Admins group grants that user full access rights to Active Directory and other IT systems that use Windows authentication. If an IT pro adds a user to Admins without a valid reason, it can result in the deletion of critical organizational units, domain controller shutdown or a security breach. To ensure system security, it’s vital to continuously monitor all changes made to the Domain Admins group and be able to quickly determine who added a user to the Domain Admins group.

Native Auditing

Configure Audit Policy Settings by running GPMC.msc

  •  Create a new policy and assign it to your domain or edit "Default Domain Policy" → Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → Audit Policy → Audit account management → Define → Success.

Configure object-level Active Directory auditing settings by opening ADSI Edit

  •  → Connect to "Default naming context"→ Click "OK" → Right-click DomainDNS object with the name of your domain → Properties → Security (Tab) → Advanced (Button) → Auditing (Tab) → Add Principal "Everyone" → Type "Success" → Applies to "This object and Descendant objects" → Permissions: → Select all check boxes except the following: "Full Control", "List Contents", "Read all properties", "Read permissions" → Click "OK".

Enlarge security event log capacity by running GPMC.msc

  •  → Edit the policy you've created → Computer Configuration → Policies → Windows Settings → Security Settings → Event Log → Define:
    • Maximum security log size to 4gb
    • Retention method for security log to "Overwrite events as needed".
    • Run "gpupdate /force" command.

Filter security log

  • Run eventvwr.msc and filter security log for event id 4728 to detect when users are added to security-enabled global groups. The group name in our case is "Domain Admins".

https://img.netwrix.com/landings/howtofriday/Native_how_to_detect_membership_changes_in_domain_admins_group.png

Real-Life Use Case Video

View 

Credits

Originally posted - https://www.netwrix.com/how_to_detect_membership_changes_in_domain_admins_group.html