Directory Services Auditing

http://support.microsoft.com/kb/232714/

Enable Auditing of Active Directory

// To enable auditing of Active Directory:

1. Start the Active Directory Users and Computers snap-in by clicking Start, pointing to Programs, and then pointing to Administrative Tools.
2. On the View menu, click Advanced Features.
3. Right-click the Domain Controllers container, and then click Properties.
4. Click the Group Policy tab.
5. Click Default Domain Controller Policy, and then click Edit.
6. Double-click the following items to open them: Computer Configuration, Windows Settings, Security Settings, Local Policies, Audit Policy.
7. In the right pane, open Audit Directory Services Access.
8. Click the appropriate option(s): Audit Successful Attempts and/or Audit Failed Attempts.
9. Open the Security Log to view logged events.

http://technet.microsoft.com/en-us/library/cc739112(WS.10).aspx

Refresh GPO.

About these ads