Keeping Active Directory secure is one of the most critical tasks for organizations' information security. Keeping track of users' activity is a fundamental part of AD security. But before jumping into purchasing shiny tools, there's a lot you can do by simply changing and leveraging AD built-in audit capabilities.
In this article I'll list all recommended AD auditing rules:
- Account logon audit.
- Account management audit.
- Active Directory access audit.
- Principles in choosing your audit policy
Active Directory Account logon audit rules:
Set ‘Audit Kerberos Authentication Service’ to ‘Success and Failure’
This setting is configured to audit only Success by default.
An event is generated after a Kerberos authentication TGT request. Auditing this event will help to mitigate attackers from impersonating a user.
Events ID:
#4768- A TGT was requested.
#4771- Kerberos pre-authentication failed
#4722- A Kerberos authentication ticket request failed.
Set ‘Audit Kerberos Service Ticket Operations’ to ‘Success and Failure’
This setting is configured to audit only Success by default.
Auditing Kerberos Service Ticket (TGS) requests will record the IP address of the requesting account and the type of encryption that was used.
Events ID:
#4769: Kerberos ticket request.
#4470: Kerberos service ticker was renewed.
#4773: A Kerberos ticket request failed.
Active Directory Account Management Audit Rules:
Ensure ‘Audit Computer Account Management’ is set to include ‘Success’
This rule will ensure you keep track of account management events. Such events include accounts being created, deleted, changes, renamed, disabled, and enabled.
Events ID:
# 4741: account was created.
# 4742: account was changed.
# 4743: account was deleted.
Ensure ‘Audit Distribution Group Management’ is set to include ‘Success’:
This rule will allow you to track events of distribution group management. Such events include the creation of a distribution group, change, delete, and change in the distribution group structure.
Events ID:
# 4744: Security-disabled local group was created.
# 4745: Security-disabled group was changed.
# 4747: A member was removed from a security-disabled group.
# 4748: A security-disabled local group was deleted.
# 4749: A security-disabled global group was created.
# 4750: A security-disabled global group was changed.
# 4751: A member was added to a security-disabled global group.
# 4752: A member was removed from a security-disabled global group.
# 4753: A security-disabled global group was deleted.
# 4759: A security-disabled universal group was created.
# 4760: A security-disabled universal group was changed.
# 4761: A member was added to a security-disabled universal group.
# 4762: A member was removed from a security-disabled universal group.
# 4763: A security-disabled universal group was deleted.
How to Configure Domain Controllers for Enhanced Security- User Rights
Set ‘Audit Other Account Management Events’ to include ‘Success’
This setting is configured as No Auditing by default.
This rule will allow you to track password-related activities.
Events ID:
# 4782: An account's password hash was accessed.
# 4793: The Password Policy Checking API was called.
Active Directory Access Audit Rules:
Set ‘Audit Directory Service Access’ to include ‘Failure’
This setting is configured to audit only Success by default.
This rule will allow you to track access to an Active Directory Domain Services object. The events in this category will only be generated by objects with SACLs (these events are similar to the directory service access events in older Windows Server versions). This rule applies only to Domain Controllers.
Events ID:
# 4662: an operation was performed on an object.
Set ‘Audit Directory Service Changes’ to include ‘Success’
This setting is configured as No Auditing by default.
This rule will allow tracking changes in Active Directory Domain Services (DS). Such events include creating, modifying, moving, and undeleting operations on an object. DS change events indicate the old and the new values of the changed properties of the changed objects.
Only objects with SACLs will be audited, and only when they are accessed in a manner that matches their SACL. This rule applies only to Domain controllers.
Events ID:
# 5136: A directory service object was modified.
# 5137: A directory service object was created.
# 5138: A directory service object was undeleted.
# 5139: A directory service object was moved.
Principles in choosing your Active Directory audit policy:
Setting an audit policy is a matter of balance between having too lax to too severe audit rules. Having a lax policy will make the audit useless in case you'll be needing to investigate malicious activity in the network. On the other hand, having too severe audit settings important and suspicious logs might be missed from being flooded with data. In addition, it will take data storage that might affect your computer performance.
A good place to start will be to understand if there are any specific regulatory requirements and use them and the base of your audit policy.
