Change Auditor for Active Directory 7.2

Introduction Change Auditor for Active Directory Events

Active Directory Database Active Directory Federation Services - Authentication Methods Active Directory Federation Services - Claims Provider Trusts Active Directory Federation Services - Endpoints Active Directory Federation Services - Relying Party Trusts Active Directory Federation Services - Server Farm Configuration Monitoring Connection Object Custom AD Object Monitoring Custom Computer Monitoring Custom Group Monitoring Custom User Monitoring DNS Service DNS Zone Domain Configuration Dynamic Access Control Forest Configuration FRS Service Group Policy Item Group Policy Object IP Security NETLOGON Service NTDS Service Organizational Unit (OU) Replication Transport Schema Configuration Site Configuration Site Link Bridge Configuration Site Link Configuration Subnets SYSVOL

Log Events

InTrust for AD event log InTrust for ADAM event Log

Domain Configuration

Table 15. Domain Configuration events
Event	Description	Severity
Allowed DNS Suffix List Changed for Domain	Created when a new value is added to or removed from the list of allowed DNS suffixes for a domain.	Medium
DACL Changed on AdminSDHolder Object	Created when the DACL is changed for an object located at CN=AdminSDHolder,CN=System, DC=<Domain Name>. NOTE: Change Auditor access control list (ACL) events (discretionary access control list (DACL) and system access control list (SACL) changes), will not report inherited access control entry (ACE) changes. This event does NOT report inherited ACL changes.	High
DACL Changed on Domain Object	Created when the DACL is changed on a domain object. NOTE: Change Auditor access control list (ACL) events (discretionary access control list (DACL) and system access control list (SACL) changes), will not report inherited access control entry (ACE) changes. This event does NOT report inherited ACL changes.	High
Default Quota for Partition Changed	Created when the default object quota for the Configuration NC, a domain NC, or an application partition is changed.	Medium
Domain Controller Added to Domain	Created when a new domain controller is promoted into the domain.	Medium
Domain Controller Removed from Domain	Created when a domain controller is demoted from the domain.	Medium
Domain Controller Renamed	Created when a domain controller is renamed.	Medium
Domain Functional Level Changed	Created when the domain functional level is changed.	Medium
Domain Group Policy Order Changed	Created when the list of group policies linked to a domain is re-ordered.	Medium
Guest Account Disabled	Created when the Guest account is disabled in a domain.	Medium
Guest Account Enabled	Created when the Guest account is enabled in a domain.	Medium
Infrastructure FSMO Role Owner Moved	Created when the infrastructure FSMO role owner is changed from one DC to another.	High
Inheritance Setting Changed on AdminSDHolder Object	Created when the inheritance setting of an AdminSDHolder object is changed.	High
Object Quota Added	Created when a new object quota is added to an NC.	Medium
Object Quota Removed	Created when an object quota is removed from an NC.	Medium
PDC FSMO Role Owner Moved	Created when the PDC FSMO role owner is changed from one DC to another.	High
Quota Security Principal Changed	Created when the security principal for an existing quota is changed.	Medium
Quota Value Changed	Created when the quota value for an existing quota is changed.	Medium
Read-Only Domain Controller Added to Domain	Created when a Read-Only Domain Controller is added to a domain.	Medium
Read-Only Domain Controller Removed from Domain	Created when a Read-Only Domain Controller is demoted.	Medium
Read-Only Domain Controller Renamed	Created when a Read-Only Domain Controller is renamed.	Medium
RID FSMO Role Owner Moved	Created when the RID FSMO role owner is changed from one DC to another.	High
Tombstone Quota Factor for Partition Changed	Created when the quota factor for tombstone objects is changed for the Configuration NC, a domain NC, or an application partition.	Medium
Trust Added	Created when a Trust is created between 2 domains.	Medium
Trust Removed	Created when a Trust is removed.	High

Dynamic Access Control


	NOTE: Dynamic Access Control is available in Windows® Server 2012; therefore, the events in this facility do not apply to earlier versions of Windows Server.

Table 16. Dynamic Access Control events
Event	Description	Severity
Central Access Policy Created	Created when a Central Access Policy is created.	Medium
Central Access Policy Description Changed	Created when the description of a Central Access policy is changed.	Medium
Central Access Policy Deleted	Created when a Central Access Policy is deleted.	Medium
Central Access Policy Permission Changed	Created when the permission of a Central Access Policy is changed.	High
Central Access Policy Rule Added	Created when a rule is added to a Central Access Policy.	Medium
Central Access Policy Rule Changed	Created when a rule for a Central Access Policy is changed.	Medium
Central Access Policy Rule Removed	Created when a rule is removed from a Central Access Policy.	Medium
Central Access Rule Created	Created when a central access rule is created.	Medium
Central Access Rule Description Changed	Created when the description of a central access rule is changed.	Medium
Central Access Rule Deleted	Created when a central access rule is deleted.	Medium
Central Access Rule Effective Permission Changed	Created when the effective permission of a central access rule is changed.	High
Central Access Rule Permission Changed	Created when the permission of a central access rule is changed.	High
Central Access Rule Proposed Permission Changed	Created when the proposed permission of a central access rule is changed.	High
Central Access Rule Target Resource Changed	Created when the target resource of a central access rule is changed.	Medium
Claim Type AD Attribute Changed	Created when an AD attribute for a claim type is changed.	Medium
Claim Type Class Added	Created when a claim type class is added.	Medium
Claim Type Class Changed	Created when a claim type class is changed.	Medium
Claim Type Class Removed	Created when a claim type class is removed.	Medium
Claim Type Created	Created when a claim type is created.	Medium
Claim Type Deleted	Created when a claim type is deleted.	Medium
Claim Type Description Changed	Created when the description of a claim type is changed.	Medium
Claim Type Disabled	Created when a claim type is disabled.	Medium
Claim Type Display Name Changed	Created when the display name of a claim type is changed.	Medium
Claim Type Enabled	Created when a claim type is enabled.	Medium
Claim Type Permission Changed	Created when the permission of a claim type is changed.	High
Claim Type Suggested Values Changed	Created when the suggested values of a claim type are changed.	Medium
Reference Resource Property Created	Created when a reference resource property is created.	Medium
Reference Resource Property Deleted	Created when a reference resource property is deleted.	Medium
Reference Resource Property Description Changed	Created when the description of a reference resource property is changed.	Medium
Reference Resource Property Disabled	Created when a reference resource property is disabled.	Medium
Reference Resource Property Display Name Changed	Created when the display name of a reference resource property is changed.	Medium
Reference Resource Property Enabled	Created when a reference resource policy is enabled.	Medium
Reference Resource Property Permission Changed	Created when the permission of a reference resource policy is changed.	High
Resource Property Created	Created when a resource property is created.	Medium
Resource Property Deleted	Created when a resource property is deleted.	Medium
Resource Property Description Changed	Created when the description for a resource property is changed.	Medium
Resource Property Disabled	Created when a resource property is disabled.	Medium
Resource Property Display Name Changed	Created when the display name for a resource property is changed.	Medium
Resource Property Enabled	Created when a resource property is enabled.	Medium
Resource Property Permission Changed	Created when the permission for a resource property is changed.	High
Resource Property Suggested Values Changed	Created when the suggested values for a resource property are changed.	Medium
Resource Property List Created	Created when a resource property list is created.	Medium
Resource Property List Deleted	Created when a resource property list is deleted.	Medium
Resource Property List Description Changed	Created when the description of a resource property list is changed.	Medium
Resource Property List Member Added	Created when a member is added to a resource property list.	Medium
Resource Property List Member Changed	Created when a member of a resource property list is changed.	Medium
Resource Property List Member Removed	Created when a member is removed from a resource property list.	Medium
Resource Property List Permission Changed	Created when the permission of a resource property list is changed.	High

Forest Configuration

Table 17. Forest Configuration events

Event

Description

Severity

Alternate UPN Suffix Added to Enterprise

Created when an entry is added to the list of alternate UPN suffixes available for user names.

Medium

Alternate UPN Suffix Removed from Enterprise

Created when an entry is removed from the list of alternate UPN suffixes available for user names.

Medium

Cross-forest Trust Added

Created when a trust is created between 2 forests.

Medium

Cross-forest Trust Removed

Created when a trust is removed between 2 forests.

High

Domain Added

Created when a domain is added to the partitions container.

High

Domain FSMO Role Owner Moved

Created when the domain naming FSMO role owner is changed from one DC to another.

High

Domain Removed

Created when a domain is removed from the partitions container.

High

Extended Access Right Added

Created when a new extended access right object is added to the system.

Medium

Extended Access Right Removed

Created when an extended access right object is removed from the system.

Medium

Forest Functional Level Changed

Created when the forest functional level is changed.

High

GC Added

Created when a domain controller is promoted from a non-GC to a GC.

Medium

GC Removed

Created when a domain controller is demoted from a GC to a non-GC.

High

Member Added to Critical Enterprise Group

Created when a new member is added to one of the critical enterprise groups. Critical enterprise groups include:

•

Server Operators

•

Print Operators

•

Network Configuration Operators

•

Incoming Forest Trust Builders

•

•

•

•

•

•

•

•

•

Group Policy Creator Owners

•

RAS and IAS Servers

•

Schema Admins

High

Member Removed from Critical Enterprise Group

Created when a new member is removed from one of the critical enterprise groups. Critical enterprise groups include:

•

Server Operators

•

Print Operators

•

Network Configuration Operators

•

Incoming Forest Trust Builders

•

•

•

•

•

•

•

•

•

Group Policy Creator Owners

•

RAS and IAS Servers

•

Schema Admins

High

Nested Member Added to Critical Enterprise Group

Created when a member is added to a nested group in a critical enterprise group.

High

Nested Member Removed from Critical Enterprise Group

Created when a member is removed from a nested group in a critical enterprise group.

Medium

Query Policy Added

Created when a new domain controller query policy is added.

Low

Query Policy Removed

Created when a domain controller query policy object is removed.

Low

Schema FSMO Role Owner Moved

Created when the schema FSMO role owner is changed from one DC to another.

High

Site Added

Created when a new site is added to the forest.

Medium

Site Link Added

Created when a site link is added to either the IP or SMTP containers.

Medium

Site Link Bridge Added

Created when a site link bridge is added to either the IP or SMTP containers.

Medium

Site Link Bridge Removed

Created when a site link bridge is removed from either the IP or SMTP containers.

High

Site Link Removed

Created when a site link is removed from either the IP or SMTP containers.

High

Site Removed

Created when a site is removed from the forest.

High

Site Renamed

Created when an existing site is renamed.

Medium

Subnet Added

Created when a new subnet is added.

Medium

Subnet Removed

Created when a subnet is removed.

High

FRS Service

Table 18. FRS Service events
Event	Description	Severity
FRS Access Check Changed	Created when an FRS access check is changed.	Low
FRS Directory Exclusion Filter List Changed on Domain Controller	Created when the FRS directory exclusion filter list on a domain controller is changed.	Low
FRS Directory Exclusion Filter List Changed on Replica Set	Created when the FRS directory exclusion filter list on a Replica Set is changed.	Low
FRS File Exclusion Filter List Changed for Replica Set	Created when the FRS file exclusion filter list on a Replica Set is changed.	Low
FRS File Exclusion Filter List Changed on Domain Controller	Created when the FRS file exclusion filter list on a Domain controller is changed.	Low
FRS Mutual Authentication Setting Changed	Created when the FRS mutual authentication is changed.	Low
FRS RPC TCP/IP Port Assignment Changed	Created when the FRS TCP/IP port assignment is changed.	Low
FRS Staging Space Limit Changed	Created when the FRS Staging space limit is changed.	Low
FRS Working Directory Changed	Created when the FRS working directory is changed.	Low

Documents connexes

The document was helpful.

Sélectionner une évaluation

I easily found the information I needed.

Sélectionner une évaluation

Veuillez sélectionner votre produit

Afin de mieux répondre à vos besoins, précisez l'objet du tchat:

Solutions recommandées pour votre problème

Change Auditor for Active Directory 7.2 - Event Reference Guide

Domain Configuration

Dynamic Access Control

Forest Configuration

FRS Service