Mastering Active Directory

Enabling advanced security audit policies

As we have seen previously, for successful auditing, we need to have SACL configured for the relevant AD objects. If there is no SACL entry, no events will be generated against that object. In order to configure SACL, we need domain admin or enterprise admin privileges. To add an SACL entry, perform the following steps:

1. Open Active Directory Users and Computers.
2. Click on View | Advanced Features.
3. Right-click on the OU or the object that you'd like to enable auditing for. Then click on Properties. In my example, I am using the root container as I wish to enable it globally.
4. Click on the Security tab and then on Advanced.

5. Click on the Auditing tab and then click on the Add button to add a new security ...