How to configure Change Auditor to capture changes made to Fine-Grained Password and Account Lockout Policies (4320807)

By default, Change Auditor is not configured to capture changes that are made to Active Directory Domain Services Fine-Grained Password and Account Lockout policies.  

These policy types were introduced in Windows Server 2008 and higher, and are stored in the AD DS Password Settings Container, which is created by default under the System container.

https://technet.microsoft.com/en-ca/library/cc770842(v=ws.10).aspx

WORKAROUND:

The following steps will configure Change Auditor to capture changes made to these policy types:

1. Open the Change Auditor Client and sign in
2. Click the View button along the top menu bar, and then select the Administration option.
3. On the Administration Tasks tab, click the Auditing button on the left side of the console, beneath the tree view.  Then, in the tree view - select the Active Directory category located just under the Forest section.  Click to highlight the Enterprise template and then click the Edit button.
4. In the Active Directory Auditing Wizard window that appears, on the left hand side under UnAudited Object Class, search for the Object Class "msDS-PasswordSettings" click to select it and then click the Add button - then Finish.
5. Now that the object class has been included in the Enterprise template, the associated Active Directory attributes with this object class will have to also be added.  This can be done using both ADSI Edit or the following link that contains all the Fine-Grained Password Policy related attributes:
   
   
   https://technet.microsoft.com/en-us/library/cc754461.aspx

6. Once the list of attributes to be audited has been decided, then can then be added by clicking on the Attributes section, located in the tree view under Forest | Active Directory.
7. Click to select the new Object Class that was added (msDS-PasswordSettings) and then in the Unmonitored Attribute section - select and add the desired attributes.
8. Once these changes have been made, they will be automatically applied to all Change Auditor agents within 15 minutes - or they can be pushed immediately by using the Refresh Configuration button, by clicking on the Configuration button below the tree view in the client window.

STATUS:

Feature Enhancement TF594232 has been logged to include this functionality by default, in a future release of Change Auditor.