Return
-
Title
Is there a way to monitor the "Trusted for Delegation" property on computer or server objects? -
Description
In some situations, it may be necessary to monitor unique attributes or options for computer/server objects such as "Trusted for Delegation". Is this possible to monitor with Change Auditor Agents? -
Cause
Unique values like "Trusted for Delegation" are tracked using the Useraccountcontrol attribute with numerical values. Useraccountcontrol is not audited by default and must be added for auditing. -
Resolution
- Add Useraccountcontrol to monitored attributes and refresh the agent configuration as per the following article:
https://support.quest.com/change-auditor/kb/177229 - When the "Trusted for Delegation" or any other UserAccountControl value is changed on an object, utilize this Microsoft Article to reference the values to their corresponding action:
https://support.microsoft.com/en-us/kb/305144
In this case, if "Trusted for Delegation" was turned on, the value would be changed to 524288.
By utilizing these two articles, one can track any useraccountcontrol based change and determine the initiator and all event details needed. - Add Useraccountcontrol to monitored attributes and refresh the agent configuration as per the following article: