Audit this events Expand / Collapse
Author
Message
Posted 1/21/2022 6:29:51 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 1/21/2022 10:06:14 PM
Posts: 1, Visits: 2
Hello

I want to audit these events, but I am having some problems, as sometimes they are generated and sometimes not. It is probably a configuration error, as in some domains it works but not in others.

First of all I have made sure that the correct audit policy is activated, in this case I think it is "Audit policy change". Through a GPO that applies to the DCs and servers in that domain.

Then, I try to execute the alert by changing in the default domain policy in the "user assigments rights" section the "Generate Security Audits" permission.

The problem is that looking at the logs, what I see is an eventID 5136 Success Audit: A directory service object was modified. I know this because I have looked at the times before and it coincides with the permission change.

In short, I don't know why event 4704 is not fired.

Best regards and thank you very much

Post #11683
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 10:53pm

Upcoming Webinars
    Additional Resources