Quick Reference Guide

Group Policy Auditing

Windows 2008-2012R2

Audit Policy Settings

Run GPMC.msc (url2open.com/gpmc) > open Default Domain Controllers Policy > Computer
Configuration > Policies > Windows Settings > Security Settings:
Advanced Audit Policy Configuration > Audit Policies > Object
Access > Audit File System > Define > Success and Failures
Advanced Audit Policy Configuration > Audit Policies > Object
Access > Audit Handle Manipulation > Define > Success and
Failures
Local Policies > Audit Policy > Audit directory service access >
Define > Success and Failures

Event ID
Reference
(2008-2012)

Object-level GP Auditing

Open ADSI Edit (url2open.com/adsi) > Connect to Default naming

context > DC=domain name > CN=System > right click CN=Policies >
Properties > Security (Tab) > Advanced > Auditing (Tab) > Click Add
> Choose the following settings:
Principal: Everyone; Type: Success; Applies to: This object and all
descendant objects; Permissions: Create groupPolicyContainer
objects, Delete groupPolicyContainer objects > Click OK

Sysvol-level GP Auditing

Navigate to the \\domainname\sysvol\domainfqdn > right-click

Policies folder and select Properties
Select the Security tab > Advanced button > Auditing tab > Click
Add
Select Principal: Everyone; Select Type: All; Select Applies to: This
folder, subfolders and files; Select the following Advanced
Permissions: Create files / write data; Create folders / append data;
Write attributes; Write extended attributes; Delete; Delete subfolders
and files
Click OK three times
To define what group policy setting was modified filter Event Viewer
for Event ID 4663 and search for Object Name: string, where you
can find the path to policy setting that was changed

4662 - An operation was

performed on an object
(Object Type:
groupPolicyContainer)

4663 - Object access attempt

(Task Category: File System)

Security Event Log Settings

Run GPMC.msc > open Default Domain Controllers Policy >

Computer Configuration > Policies > Windows Settings > Security
Settings > Event Log > Define:
Maximum security log size to 1gb
Retention method for security log to Overwrite events as needed
Open Event viewer on any domain controller and search Security log
for event ids listed in the Event ID Reference box

Gain #completevisibility into all activity going on in your AD and GP

for free with Netwrix Auditor for Active Directory:
netwrix.com/go/trial-ad
Corporate Headquarters:
300 Spectrum Center Drive, Suite 1100,
Irvine, CA 92618

Toll-free: 888-638-9749

Int'l: 1-949-407-5125
EMEA: 44 (0) 203-318-0261

netwrix.com/social