Windows Security Monitoring

CHAPTER 7Microsoft Active Directory

Microsoft Active Directory provides the ability to centrally manage assets in your network environment. It also acts as a foundation for many other technologies, such as Active Directory Federation Services, Public Key Infrastructure service, RADIUS servers, and many other services and components.

In this chapter you will find information about the most common monitoring scenarios for Active Directory, such as user or computer account creation, operations with groups, operations with trusts, and so on. Chapter 8 builds on this chapter with detailed information about monitoring Active Directory changes and operations with objects, such as group policy creation and organization unit modification, as well as others.

Active Directory Built-in Security Groups

In addition to the standard security groups included in any Windows server operating system, which were discussed in Chapter 6, a number of special security groups are available after a server is promoted to an Active Directory domain controller. In this section you will find information about the additional security groups that exist in an Active Directory domain environment.

Administrators

Administrators is a built-in domain local security group. Members of this group have administrative access to all Active Directory domain controllers in the domain this group is located in, which makes this group critical to monitor. By default, this group has the following members:

• Administrator ...