Audit Changes to Group Policies


An Interesting question came up at work this week. That was

How do you Audit the fact that someone has modified a Group Policy ?

Well the general concensus was the following;

Check out the following excellent blog article

Windows Security Logging and Other Esoterica : Monitoring Group Policy Changes with Windows Auditing


http://blogs.msdn.com/ericfitz/archive/2005/08/04/447951.aspx

Useful and excellent article on exactly what settings to Audit .

But also 3rd party tools have a part to play here, such as Quest and Netpro.

Comments (5)

  1. AllenRich says:

    Thanks for sharing helpful information related to audit changes to Group Policies. It found this utility from
    http://www.lepide.com/lepideauditor/group-policy.html which enables to audit and get the report on the GPO changes with the predefined reports, live feed, and real-time alerts in AD environments.

  2. Anonymous says:

    Yes, this article is quite useful, but as you said there is a place for 3rd party tools. I think it’s much easier. Not sure about the utilities you mentioned above. Personaly I prefer active administrator (I hope you’ve heard about it – it’s from scriptlogic). It has powerful <a href="http://www.scriptlogic.com/active-directory-group-policy-auditing.asp">group policy auditing</a> features and it handles just any tasks that can appear in active directory administration practices.

  3. Mr Robin says:

    i have enjoyed this great information so much. This was really very interesting and helpful to read.

    http://www.healthforus.info

  4. Rakesh says:

    Issue:- CPU Usages 25% but Ideal time showing 95% why? & how to troubleshoot.

    There are 21 Windows 2008 x86 placed in OU and out of one is server showing some difference in processor usages however if I move that server to different OU and everything becomes normal for that server. All servers are virtual machines. Can someone explain
    what to look into to fix the issue & is it GPO issue?