Решения для управления доменами Windows Active Directory

How to perform Real-Time Audit of Active Directory Domains?

How to perform real-time audits of an Active Directory domain or subdomain?

I want to audit events related to my Active Directory domain in real time. In particular, I want to know which users belong to certain sensitive groups such as "Domain Admins" and "Administrators". Is this possible with IDEAL Administration?

IDEAL Administration allows you to monitor and analyze, in real time, all activities and modifications made to your domains (From version 25.0).

You can audit more than 60 events of your Active Directory domain and/or subdomain in order to:

- Quickly detect the security problem,
- Monitor unauthorized changes,
- Have a quick diagnosis of incidents,
- Check the compliance of your environment with the policy applied in your organization,
- Optimize network performance and reduce connection errors.

- A graph representing the event timeline for a graphical representation of the audited events.
- A complete visualization of the audited events.
- The configuration of the audit system (User groups deemed sensitive, number of days, etc.)
- No complex settings, nor agents to install, everything is done automatically from your Active Directory manager.

How to add the "Real Time Audits" tab to IDEAL Administration?

The Real-Time Audits sub-tab is automatically added to the application when you add an Active Directory Domain tab.

Audits are automatically performed for the domain configured with a default configuration that we have defined.

You can then modify the configuration by specifying a sub-or, the events to audit, the events placed in Favorite or the number of days to check for each event, Action menu, Configure.

What events are audited?

- Contacts deleted in the last x days (default 30)
- Contacts modified in the last x days (default 2)
- Contacts created in the last x days (default 7)
- Contacts managed (manager)
- GPOs modified in the last x days (default 2)
- GPOs created in the last x days (default 7)
- Inactive GPOs
- Active GPOs
- User groups deleted in the last x days (default 30)
- User groups modified in the last x days (default 2)
- User groups created in the last x days (default 7)
- User groups of different types
- User groups with SIDHistory configured
- User groups managed (managedBy)
- Printers deleted in the last x days
- Printers modified in the last x days (default 2)
- Printers created in the last x days (default 2)
- Printers managed (manager)
- Users with a password expiring in x days (default 7)
- Users with a password unchanged for x days (default 90)
- Users with a password that never expires
- Users with an expired password
- Users who cannot change their password
- Computers deleted in the last x days (default 30)
- Cmputers never connected to the domain
- Computers not connected to the domain for x days (default 30)
- Computers that have logged in in the last x days (default 7)
- Computers managed (managedBy)
- Computers created in the last x days (default 7)
- Computers modified in the last x last days (default 2)
- Dfferent operating systems
- Number of domain controllers
- Number of servers
- Workstations already logged in to the domain
- Disabled computers
- Active computers
- OUs deleted in the last x days (default 30)
- OUs modified in the last x days (default 2)
- OUs created in the last x days (default 7)
- OUs not linked to a GPO
- OUs linked to a GPO
- OUs managed (managedBy)
- Users deleted in the last x days (default 30)
- Users not logged in in the last x days (default 365)
- Users logged in in the last x days (default 2)
- Users modified in the last x days (default 2)
- Users created in the last x days (default 7)
- Users locked in x days (default 14)
- Users who have opened more than x sessions on the domain (default 200)
- Users who have entered an incorrect password in the last x days (default 7)
- Users belonging to sensitive groups
- Users with an email
- Users with a superior (Manager)
- Locked users
- Users who must connect from certain computers
- Users with SIDHistory configured
- Users with connection times
- Users who have never connected to the domain
- Deactivated users
- Active users