Forum

Ultimate Windows Security Forum » IT Audit » Active Directory » Logging computer moves between OU's

Logging computer moves between OU's Expand / Collapse
Rate Topic
Display Mode
Topic Options
Author
Message
des2009
Posted 8/13/2009 3:31:38 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 8/14/2009 2:11:55 PM
Posts: 2, Visits: 2
What auditing events or other dependencies must be enabled to record these issues:

1.  when a computer account is moved between OU's? 

2.  when GPO's are applied or removed from computer accounts

Post #174
RandyFranklinSmith
Posted 8/14/2009 7:46:26 AM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 326, Visits: 0
If you have "Audit Directory Service Access" and you have enabled auditing on the 2 OUs in question for Everyone and at least Create/Delete All Child Objects as well as Delete access on all objects you will get 2 566 events: one showing the computer being deleted, the other showing a Create Child event in the new OU.
Post #177
des2009
Posted 8/14/2009 9:40:30 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 8/14/2009 2:11:55 PM
Posts: 2, Visits: 2
thank you very much!! 
Post #178
RandyFranklinSmith
Posted 8/28/2010 4:42:12 PM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 326, Visits: 0
welcome!
Post #436
Lee Juses11
Posted 10/21/2010 10:14:52 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 10/21/2010 10:00:11 PM
Posts: 1, Visits: 0
Thank you very much!


__________________

cures for depression
Post #504
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 9:14am