Jump to content
jminner

Monitoring for Domain Admins

Recommended Posts

So I looked around and did not see anything, so I am coming here for assistance.  Would anyone know of a way that you can monitor for Domain Admins and Enterprise Admins?  Specifically if a user has been added to those groups so that we can get alerts on it?  Any help would be appreciated.

 

Thanks

Jason

Share this post


Link to post
Share on other sites

You can add a remote monitor for Security Success Audit of EventID 4728 with text "Domain Admins" and EventID 4756 with text of "Admins" (to cover Enterprise and Schema Admins)

  • Thanks 1

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


×
×
  • Create New...