Things I like to know about. Administration Events OU creations/deletions/mods Critical Security Group Modifications GPO Creation/deletion/mods and Linking Domain Administrator Logins and from where Password changes on critical accounts Domain Activities Got one word for you Replication! AD's go bad when replication is out of whack... In my experience when it comes to replication you need to monitor both the Event Logs, but also the ports. Also if a firewall goes anywhere between two replication partners, you then have to start to consider UDP fragmentation which manifest itself as broken trust and bad authentication attempts. As for events, well the security event logs are a maze of Event ID's that I just rather not dig into unless I am required. Both Quest and Netpro (probably NetIQ, MOM and some other tools out there I haven't evaluated as well) have some nice tools that make monitoring the security event logs a lot nicer. I currently use Quest Intrust and Intrust for AD. The nice thing about the AD product is that it creates a nice little Event Log for administration and logs those activities separately. The put a hook into the LDAP service that intercepts the LDAP calls and logs them. There are some KB articles out there that list several of the events. As one person suggest, reviewing Netpro, Quest, NetIQ's and HPs stuff also helps get an idea. MoM also has some pretty slick admin packs that might be informative, but I see Mom more as a Big Picture Up/Down monitor, there is still a lot of value in Third-Party add-ons since most of these products offer add-ons to MoM as part of their features. Todd
________________________________ From: Ryan A. Conrad [mailto:[EMAIL PROTECTED] Sent: Mon 3/6/2006 4:01 PM To: [email protected] Subject: Re: [ActiveDir] AD - What to monitor? You may want to start by looking at some commercial products and see what functions they perform and what they monitor. NetPro's Change Auditor is great, and the MOM AD MP (entire Technical Guide is available) would be two nice starting points. If I remember correctly, NetPro also has an AD Health product. If you don't want to pay, then you can start scripting based upon what you see common among all of the commercial products available. Ryan On 3/6/06, Adeel Ansari <[EMAIL PROTECTED]> wrote: AD Gurus, Can you guys expand on the topic of what should be monitored in AD? and Why? I am talking in terms of Security events only to protect AD and also protect from attacks of any kind. Obviously, one would monitor failed logon, too many accounts creations etc. What else should we monitor? Regards, Adeel List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
