{"id":8202,"date":"2012-11-24T08:24:26","date_gmt":"2012-11-24T08:24:26","guid":{"rendered":"http:\/\/tajdini.net\/blog\/2012\/11\/24\/windows-server-2008-auditing-active-directory\/"},"modified":"2012-11-24T08:24:26","modified_gmt":"2012-11-24T08:24:26","slug":"windows-server-2008-auditing-active-directory","status":"publish","type":"post","link":"https:\/\/tajdini.net\/blog\/identity-and-active-directory\/windows-server-2008-auditing-active-directory\/","title":{"rendered":"Windows Server 2008: Auditing Active Directory"},"content":{"rendered":"<p dir=\"RTL\"> \t\u062d\u062a\u06cc \u0627\u06af\u0631 \u0645\u062f\u062a \u06a9\u0648\u062a\u0627\u0647\u06cc \u0627\u0633\u062a \u06a9\u0647 \u067e\u0627 \u0628\u0647 \u0639\u0631\u0635\u0647 \u0634\u0628\u06a9\u0647 \u0648 \u0645\u062f\u06cc\u0631\u06cc\u062a \u0633\u0631\u0648\u0631\u0647\u0627 \u06af\u0630\u0627\u0634\u062a\u0647 \u0627\u06cc\u062f\u060c \u062d\u062a\u0645\u0627\u064b \u0628\u0647 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u062a\u0631\u0644 \u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0628\u0631 \u062e\u0648\u0631\u062f\u0647 \u0627\u06cc\u062f. \u0627\u0645\u0627 \u0686\u0647 \u06a9\u0633\u0627\u0646\u06cc\u060c \u0686\u0647 \u0632\u0645\u0627\u0646\u06cc \u0648 \u0686\u06af\u0648\u0646\u0647 \u0627\u0632 \u062f\u0633\u062a\u0631\u0633\u06cc \u0647\u0627\u06cc\u0634\u0627\u0646 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f\u0647 \u0627\u0646\u062f \u06cc\u0627 \u0642\u0635\u062f \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u062f\u0648\u0646 \u0627\u062c\u0627\u0632\u0647 \u0628\u0647 \u0645\u0646\u0627\u0628\u0639 \u062f\u06cc\u06af\u0631\u0627\u0646 \u0631\u0627 \u062f\u0627\u0634\u062a\u0647 \u0627\u0646\u062f \u061f \u0627\u06af\u0631 \u0627\u0632 <span dir=\"LTR\">Audit logging <\/span>&nbsp;\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0646\u06a9\u0646\u06cc\u062f \u0645\u062c\u0628\u0648\u0631 \u062e\u0648\u0627\u0647\u06cc\u062f \u0628\u0648\u062f \u062a\u0645\u0627\u0645 \u0645\u062f\u062a \u062e\u0648\u062f\u062a\u0627\u0646 \u06a9\u0644 \u0634\u0628\u06a9\u0647 \u0631\u0627 \u0628\u0627 \u0686\u0634\u0645\u0627\u0646\u062a\u0627\u0646 \u0645\u0631\u0627\u0642\u0628\u062a \u06a9\u0646\u06cc\u062f <span dir=\"LTR\">\ud83d\ude00<\/span><\/p>\n<p dir=\"RTL\"> \t\u0628\u062d\u062b <span dir=\"LTR\">Auditing<\/span>\u062f\u0631 \u0646\u0633\u062e\u0647 \u0647\u0627\u06cc \u0642\u0628\u0644\u06cc <span dir=\"LTR\">Active Directory <\/span>&nbsp;\u0628\u0647 \u0648\u0633\u0639\u062a \u0633\u0631\u0648\u0631 2008 \u0646\u0628\u0648\u062f \u0648 \u0627\u06cc\u0646 \u0628\u0644\u0648\u063a \u0627\u0645\u06a9\u0627\u0646 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u062a\u0631\u0644 \u0647\u0627\u06cc \u0628\u06cc\u0634\u062a\u0631\u06cc \u0631\u0627 \u0628\u0631\u0627\u06cc \u0634\u0645\u0627 \u0628\u0647 \u0627\u0631\u0645\u063a\u0627\u0646 \u0622\u0648\u0631\u062f\u0647 \u0627\u0633\u062a.<\/p>\n<p> \t<strong>Auditing Changes in Windows Server 2008<\/strong><\/p>\n<p dir=\"RTL\"> \t\u06cc\u06a9\u06cc \u0627\u0632 \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a \u0627\u0633\u0627\u0633 \u062f\u0631 \u0648\u06cc\u0646\u062f\u0648\u0632 2003 \u0646\u0633\u0628\u062a \u0628\u0647 2000 \u0628\u0647\u0628\u0648\u062f <span dir=\"LTR\">Auditing<\/span>\u0628\u0648\u062f\u060c \u062f\u0631 \u0632\u0645\u0627\u0646 \u0648\u06cc\u0646\u062f\u0648\u0632 2000 \u0641\u0642\u0637 \u0686\u0647 \u06a9\u0633\u06cc\u060c \u06a9\u062f\u0627\u0645 <span dir=\"LTR\">attribute<\/span>\u0631\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u062f\u0627\u062f\u0647 \u0645\u062f \u0646\u0638\u0631 \u0628\u0648\u062f \u0627\u0645\u0627 \u062f\u0631 \u0648\u06cc\u0646\u062f\u0648\u0632 2003 \u0645\u0642\u0627\u062f\u06cc\u0631 \u0642\u0628\u0644 \u0648 \u0628\u0639\u062f \u0627\u0632 \u062a\u063a\u06cc\u06cc\u0631 \u0646\u06cc\u0632 \u0630\u062e\u06cc\u0631\u0647 \u0645\u06cc\u0634\u062f \u062a\u0627 \u062f\u0644\u06cc\u0644 \u062a\u063a\u06cc\u06cc\u0631 \u0645\u0634\u062e\u0635 \u06af\u0631\u062f\u062f \u06a9\u0647 \u0627\u06af\u0631 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0628\u0627\u0632\u06af\u0631\u062f\u0627\u0646\u06cc \u0628\u0648\u062f \u0645\u0634\u06a9\u0644\u06cc \u0648\u062c\u0648\u062f \u0646\u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f.<\/p>\n<p dir=\"RTL\"> \t\u062a\u063a\u06cc\u06cc\u0631 \u0645\u0647\u0645 \u062f\u06cc\u06af\u0631 \u0627\u0645\u06a9\u0627\u0646 <span dir=\"LTR\">on\/off<\/span>\u0646\u0645\u0648\u062f\u0646 <span dir=\"LTR\">Auditing Policy<\/span>\u0647\u0627\u06cc \u0628\u0648\u062f. \u062f\u0631 \u0648\u06cc\u0646\u062f\u0648\u0632 \u0633\u0631\u0648\u0631 2008 \u0627\u06cc\u0646 \u062a\u0641\u0627\u0648\u062a \u0628\u0647 \u062c\u0627\u06cc\u06cc \u0631\u0633\u06cc\u062f \u06a9\u0647 <span dir=\"LTR\">Auditing Policy<\/span>\u0647\u0627 \u062f\u0631 4 \u0632\u06cc\u0631 \u0645\u062c\u0645\u0648\u0639\u0647 \u062f\u0633\u062a\u0647 \u062a\u0641\u06a9\u06cc\u06a9 \u0634\u062f\u0646\u062f:<\/p>\n<ul>\n<li> \t\tDirectory Service Access<\/li>\n<li> \t\tDirectory Service Changes<\/li>\n<li> \t\tDirectory Service Replication<\/li>\n<li> \t\tDetailed Directory Service Replication<\/li>\n<\/ul>\n<p dir=\"RTL\"> \t\u062f\u0631 \u0627\u06cc\u0646 \u0645\u0642\u0627\u0644\u0647 \u0646\u062d\u0648\u0647 \u0641\u0639\u0627\u0644 \u0633\u0627\u0632\u06cc <span dir=\"LTR\">Directory Service Changes<\/span>\u0631\u0627 \u0645\u0648\u0631\u062f \u0628\u0631\u0631\u0633\u06cc \u0642\u0631\u0627\u0631 \u062e\u0648\u0627\u0647\u06cc\u0645 \u062f\u0627\u062f.<\/p>\n<p> \t<strong>How to Enable Global Audit Policy on Windows Server 2008<\/strong><\/p>\n<p> \tThe first step is to enable the audit policy. I will walk you through both doing it through the GUI and then through the command line:<\/p>\n<p> \t<strong>1.<\/strong>Go to <strong>Start, Administrative Tools<\/strong>, and then click on <strong>Group Policy Management<\/strong>.<\/p>\n<p> \t<img loading=\"lazy\" decoding=\"async\" class=\" size-full wp-image-8185\" alt=\"Server 2008: Auditing Active Directory - 1\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-01.png\" style=\"width: 595px; height: 141px;\" width=\"476\" height=\"113\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-01.png 476w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-01-300x71.png 300w\" sizes=\"auto, (max-width: 476px) 100vw, 476px\" \/><\/p>\n<p> \t<strong>2.<\/strong>Navigate down through your <strong>Forest<\/strong>, to the <strong>Domains<\/strong>, then <strong>Domain Controllers<\/strong> and left click on <strong>Default Domain Controllers Policy<\/strong>.<\/p>\n<p> \tYou will get a warning that changes here will impact all other locations that the GPO is linked to. Click <strong>Ok<\/strong>.<\/p>\n<p> \t<img loading=\"lazy\" decoding=\"async\" class=\" size-full wp-image-8186\" alt=\"Server 2008: Auditing Active Directory - 2\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-02.png\" style=\"width: 486px; height: 179px;\" width=\"389\" height=\"143\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-02.png 389w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-02-300x110.png 300w\" sizes=\"auto, (max-width: 389px) 100vw, 389px\" \/><\/p>\n<p> \t<strong>3.<\/strong>Right click on <strong>Default Domain Controllers Policy <\/strong>and then left click on <strong>Edit\u2026<\/strong><\/p>\n<p> \t<img loading=\"lazy\" decoding=\"async\" class=\" size-full wp-image-8187\" alt=\"Server 2008: Auditing Active Directory - 3\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-03.png\" style=\"width: 746px; height: 541px;\" width=\"597\" height=\"433\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-03.png 597w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-03-300x218.png 300w\" sizes=\"auto, (max-width: 597px) 100vw, 597px\" \/><\/p>\n<p> \t<strong>4.<\/strong>Navigate under <strong>Computer Configurations <\/strong><strong>\u2192<\/strong><strong>Policies <\/strong><strong>\u2192<\/strong><strong>Windows Settings <\/strong><strong>\u2192<\/strong><strong>Security Settings <\/strong><strong>\u2192<\/strong><strong>Local Policies <\/strong><strong>\u2192<\/strong><strong>Audit Policy<\/strong><\/p>\n<p> \t<img loading=\"lazy\" decoding=\"async\" class=\" size-full wp-image-8188\" alt=\"Server 2008: Auditing Active Directory - 4\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-04.png\" style=\"width: 746px; height: 545px;\" width=\"597\" height=\"436\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-04.png 597w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-04-300x219.png 300w\" sizes=\"auto, (max-width: 597px) 100vw, 597px\" \/><\/p>\n<p> \t<strong>5.<\/strong>Right click on <strong>Audit Directory Service Access<\/strong>, and then click <strong>Properties<\/strong>.<\/p>\n<p> \t<img loading=\"lazy\" decoding=\"async\" class=\" size-full wp-image-8189\" alt=\"Server 2008: Auditing Active Directory - 5\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-05.png\" style=\"width: 746px; height: 544px;\" width=\"597\" height=\"435\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-05.png 597w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-05-300x219.png 300w\" sizes=\"auto, (max-width: 597px) 100vw, 597px\" \/><\/p>\n<p> \t<strong>6.<\/strong>Select <strong>Define these policy settings <\/strong>and then select <strong>Success<\/strong>. Click on <strong>Apply<\/strong> and then <strong>Ok<\/strong>.<\/p>\n<p> \t<img loading=\"lazy\" decoding=\"async\" class=\" size-full wp-image-8190\" alt=\"Server 2008: Auditing Active Directory - 6\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-06.png\" style=\"width: 521px; height: 620px;\" width=\"417\" height=\"496\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-06.png 417w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-06-252x300.png 252w\" sizes=\"auto, (max-width: 417px) 100vw, 417px\" \/><\/p>\n<p> \tThat\u2019s it! You now have configured auditing via GUI.<\/p>\n<p> \tLet\u2019s take a look at the command line method (much faster):<\/p>\n<p> \t<strong>1.<\/strong>Start <strong>Command Prompt <\/strong>with elevated rights.<\/p>\n<p> \t<img loading=\"lazy\" decoding=\"async\" class=\" size-full wp-image-8191\" alt=\"Server 2008: Auditing Active Directory - 7\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-07.png\" style=\"width: 496px; height: 621px;\" width=\"397\" height=\"497\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-07.png 397w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-07-240x300.png 240w\" sizes=\"auto, (max-width: 397px) 100vw, 397px\" \/><\/p>\n<p> \t<strong>2.<\/strong>Type in the following command and hit <strong>Enter<\/strong>:<\/p>\n<p> \t<strong>auditpol \/set \/subcategory:\u201ddirectory service changes\u201d \/success:enable<\/strong><\/p>\n<p> \t<img loading=\"lazy\" decoding=\"async\" class=\" size-full wp-image-8192\" alt=\"Server 2008: Auditing Active Directory - 8\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-08.png\" style=\"width: 746px; height: 369px;\" width=\"597\" height=\"295\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-08.png 597w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-08-300x148.png 300w\" sizes=\"auto, (max-width: 597px) 100vw, 597px\" \/><\/p>\n<p> \tI told you it was much faster! You should see <strong>The command was successfully executed<\/strong>. Now let\u2019s move on to the next step.<\/p>\n<p> \t<strong>How to Setup Auditing in System Access Control List (SACL)<\/strong><\/p>\n<p> \tAs was mentioned earlier, the SACLs do most of the work in determining what gets auditing and what doesn\u2019t. Please note that there are many different types of SACLs that can be setup; we are only using one as an example.<\/p>\n<p> \t<strong>1.<\/strong>Open <strong>Active Directory Computers and Users<\/strong>.<\/p>\n<p> \t<img loading=\"lazy\" decoding=\"async\" class=\" size-full wp-image-8193\" alt=\"Server 2008: Auditing Active Directory - 9\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-09.png\" style=\"width: 746px; height: 579px;\" width=\"597\" height=\"463\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-09.png 597w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-09-300x233.png 300w\" sizes=\"auto, (max-width: 597px) 100vw, 597px\" \/><\/p>\n<p> \t<strong>2.<\/strong>Click on <strong>View<\/strong> and make sure that <strong>Advanced Features <\/strong>is enabled. If not left click on it to place a check next to it.<\/p>\n<p> \t<img loading=\"lazy\" decoding=\"async\" class=\" size-full wp-image-8194\" alt=\"Server 2008: Auditing Active Directory - 10\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-10.png\" style=\"width: 746px; height: 543px;\" width=\"597\" height=\"434\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-10.png 597w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-10-300x218.png 300w\" sizes=\"auto, (max-width: 597px) 100vw, 597px\" \/><\/p>\n<p> \t<strong>3.<\/strong>Right click on any of the Organizational Units you want to audit; in our example I am going to audit <strong>Users<\/strong>. Then click on <strong>Properties<\/strong>.<\/p>\n<p> \t<img loading=\"lazy\" decoding=\"async\" class=\" size-full wp-image-8195\" alt=\"Server 2008: Auditing Active Directory - 11\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-11.png\" style=\"width: 746px; height: 540px;\" width=\"597\" height=\"432\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-11.png 597w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-11-300x217.png 300w\" sizes=\"auto, (max-width: 597px) 100vw, 597px\" \/><\/p>\n<p> \t<strong>4.<\/strong>In the Properties window click on <strong>Security<\/strong>.<\/p>\n<p> \t<img loading=\"lazy\" decoding=\"async\" class=\" size-full wp-image-8196\" alt=\"Server 2008: Auditing Active Directory - 12\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-12.png\" style=\"width: 503px; height: 556px;\" width=\"402\" height=\"445\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-12.png 402w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-12-271x300.png 271w\" sizes=\"auto, (max-width: 402px) 100vw, 402px\" \/><\/p>\n<p> \t<strong>5.<\/strong>Next click on <strong>Advanced<\/strong>.<\/p>\n<p> \t<img loading=\"lazy\" decoding=\"async\" class=\" size-full wp-image-8197\" alt=\"Server 2008: Auditing Active Directory - 13\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-13.png\" style=\"width: 500px; height: 553px;\" width=\"400\" height=\"442\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-13.png 400w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-13-271x300.png 271w\" sizes=\"auto, (max-width: 400px) 100vw, 400px\" \/><\/p>\n<p> \t<strong>6.<\/strong>Click the <strong>Auditing<\/strong> tab, then click <strong>Add<\/strong>.<\/p>\n<p> \t<img loading=\"lazy\" decoding=\"async\" class=\" size-full wp-image-8198\" alt=\"Server 2008: Auditing Active Directory - 14\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-14.png\" style=\"width: 746px; height: 561px;\" width=\"597\" height=\"449\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-14.png 597w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-14-300x226.png 300w\" sizes=\"auto, (max-width: 597px) 100vw, 597px\" \/><\/p>\n<p> \t<strong>7.<\/strong>Under <strong>Enter the object name to select:<\/strong>, type in <strong>Authenticated Users <\/strong>and click <strong>Ok<\/strong>.<\/p>\n<p> \t<img loading=\"lazy\" decoding=\"async\" class=\" size-full wp-image-8199\" alt=\"Server 2008: Auditing Active Directory - 15\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-15.png\" style=\"width: 572px; height: 301px;\" width=\"458\" height=\"241\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-15.png 458w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-15-300x158.png 300w\" sizes=\"auto, (max-width: 458px) 100vw, 458px\" \/><\/p>\n<p> \t<strong>8.<\/strong>In the next window under <strong>Apply onto:<\/strong>select <strong>Descendant User Objects<\/strong> and under <strong>Access <\/strong>check the box for <strong>Successful<\/strong> next to <strong>Write all properties<\/strong> and click <strong>Ok<\/strong>.<\/p>\n<p> \t<img loading=\"lazy\" decoding=\"async\" class=\" size-full wp-image-8200\" alt=\"Server 2008: Auditing Active Directory - 16\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-16.png\" style=\"width: 456px; height: 580px;\" width=\"365\" height=\"464\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-16.png 365w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-16-236x300.png 236w\" sizes=\"auto, (max-width: 365px) 100vw, 365px\" \/><\/p>\n<p> \t<strong>9.<\/strong>Click <strong>Ok <\/strong>until you are out of any dialog boxes.<\/p>\n<p> \tNow that we have enabled auditing in a SACL let\u2019s go ahead and give it a test.<\/p>\n<p> \t<strong>Example: Security Events with Auditing Enabled<\/strong><\/p>\n<p> \tWith auditing enabled, all events will be logged under the Security Event Viewer. Let\u2019s see what happens when you change a value on an object.<\/p>\n<p> \tFor brevity sake, I am going to create a user called <strong>audittest<\/strong>, change his name from <strong>Audit Test <\/strong>to <strong>Test Audit <\/strong>and then we will take a look in the security log to see what was shown.<\/p>\n<p> \tThere are two images that show the change that corresponds with <strong>Event 5136<\/strong>, here is the first one which shows the value being deleted, which in this case is <strong>Audit Test<\/strong>:<\/p>\n<p> \t<img loading=\"lazy\" decoding=\"async\" class=\" size-full wp-image-8201\" alt=\"Server 2008: Auditing Active Directory - 17\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-17.png\" style=\"width: 746px; height: 634px;\" width=\"597\" height=\"507\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-17.png 597w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2012\/11\/enable-auditing-17-300x255.png 300w\" sizes=\"auto, (max-width: 597px) 100vw, 597px\" \/><\/p>\n<p> \tThe next image shows the changed object\u2019s new value which in our case is <strong>Test Audit<\/strong>:<\/p>\n<p> \t<img decoding=\"async\" alt=\"Server 2008: Auditing Active Directory - 18\" src=\"images\/images\/enable-auditing18.png\" style=\"width: 746px; height: 631px;\" \/><\/p>\n<p dir=\"RTL\"> \t\u0647\u0645\u0627\u0646\u0637\u0648\u0631 \u06a9\u0647 \u0645\u0634\u0627\u0647\u062f\u0647 \u0645\u06cc \u06a9\u0646\u06cc\u062f \u0645\u0642\u062f\u0627\u0631 \u0642\u0628\u0644\u06cc \u0648 \u0645\u0642\u062f\u0627\u0631 \u062c\u062f\u06cc\u062f \u0642\u0627\u0628\u0644 \u0645\u0634\u0627\u0647\u062f\u0647 \u0648 \u0645\u0642\u0627\u06cc\u0633\u0647 \u0647\u0633\u062a\u0646\u062f \u0648 \u0634\u0645\u0627 \u0628\u062f\u0648\u0646 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0647\u06cc\u0686 <span dir=\"LTR\">Backup<\/span>\u06cc \u0645\u06cc\u062a\u0648\u0627\u0646\u06cc\u062f \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a \u0631\u0627 \u0628\u0647 \u062d\u0627\u0644\u062a \u0642\u0628\u0644 \u0628\u0631\u06af\u0631\u062f\u0627\u0646\u06cc\u062f.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u062d\u062a\u06cc \u0627\u06af\u0631 \u0645\u062f\u062a \u06a9\u0648\u062a\u0627\u0647\u06cc \u0627\u0633\u062a \u06a9\u0647 \u067e\u0627 \u0628\u0647 \u0639\u0631\u0635\u0647 \u0634\u0628\u06a9\u0647 \u0648 \u0645\u062f\u06cc\u0631\u06cc\u062a \u0633\u0631\u0648\u0631\u0647\u0627 \u06af\u0630\u0627\u0634\u062a\u0647 \u0627\u06cc\u062f\u060c \u062d\u062a\u0645\u0627\u064b \u0628\u0647 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u062a\u0631\u0644 \u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0628\u0631 \u062e\u0648\u0631\u062f\u0647 \u0627\u06cc\u062f. \u0627\u0645\u0627 \u0686\u0647 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":8185,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[226,229,235],"tags":[125,120,259,264,176,112],"class_list":["post-8202","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-identity-and-active-directory","category-network-and-protocol-security","category-windows-and-server","tag-active-directory","tag-auditing","tag-network-security","tag-persian","tag-windows","tag-windows-server-2008"],"_links":{"self":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8202","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/comments?post=8202"}],"version-history":[{"count":0,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8202\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media\/8185"}],"wp:attachment":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media?parent=8202"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/categories?post=8202"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/tags?post=8202"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}