Regresar
-
Título
Change Auditor reports a failed event of an object being added to a AD group incorrectly. -
Descripción
Change Auditor reports a failed event of an object being added to a AD group but when we check the AD group the object is actually present.
The Change Auditor logs will show the action User Added to Group as Result: Failed
-
Causa
- When a User is present in AD Group, this user can't be added again, this will generate an error.
- If done from the AD User Interface, an error message will display and the operation will be cancelled.
- However if one uses PowerShell command to add the user, this action will not generate an error in PowerShell but a error code will be displayed in Change Auditor logs
-
Resolución
- As Change Auditor collects audit data from LSASS on the DCs this is expected results
- To avoid this event to be displayed, make sure that no script is run regularly trying to add already present users to a group.