How to Get Logs for Authentications of Login and Shared Network access for Domain users in AD Domain Controller.

Question

How to Get Logs for Authentications of Login and Shared Network access for Domain users in AD Domain Controller.

Researcher 11

I am working on a small project with around 150 users in a Domain Environment

I am searching for a method to Obtain or to Generate - Domain authentication logs of Domain users when logged in to domain computers or when accessing share drives. The log is to be generated in the domain controller itself.

I also require the log to have the details like:

AD domain controller authenticating a Domain user for both login to workstations and when accessing network shares, which user (username) was authenticated and PC name or IP address of user computer, time of authentication, Destination of user.

I have tried using ‘Audit Account Logon’ and ‘Audit logon’ GPO under “Audit Policy" , and "Logon/Logoff" GPO under Advanced Audit Policy , the logs are generated in domain controller based on event number and need to be filtered every time to see the login details . Also all required details are not present in here.

I found few alternative tools like ADManager plus, ADAudit plus, Adinfo (form cjwdev) , Netwrix Auditor for AD , but not sure which one has the best features.

Need help here. Please suggest any alternative methods or free software’s that could be used. Any ideas are appreciated.

2 answers

Your answer

Answer 1

JimmySalian-2011 42,511

Hi,

Thank you for asking this question on the Microsoft Q&A Platform.

I guess you are on the right path with regards to setting up the auditing on the DC via the GPO, also this link will provide details tracking and notification of each user activity. So can be used and yes it will be bit of extracting the logs and filtering out as per the requirement. monitoring-active-directory-for-signs-of-compromise

Recommended and I have used SCOM product to monitor and alerts as per requirements details.aspx

Also Solarwinds is a good tool but it is third party so please review docs and decide which one is preferred by your team.
user-activity-monitoring

==
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Researcher 11 Reputation points

2022-08-22T07:05:49.6+00:00

Thanks for replying and sharing the link . Extracting the logs and filtering out as per the requirement works but its a lot of effort for the person who has to find immediate details of authentication events (network shares and shared folders access) . From the link , If Audit Logon event is enabled it is stated that "If a network logon takes place to access a share, these events generate on the computer that hosts the accessed resource" , is there any method to write these logs in the AD Domain controller itself. (Please provide ideas if any).
JimmySalian-2011 42,511 Reputation points

2022-08-22T08:55:44.003+00:00

Hi,

I agree that it will take bit of processing, so the option is to use SCOM and it the SCOM Management Packs can be installed, configured to alert on specific alerts directly to email or can be processed on the SCOM Console.

The options are basically to enable the auditing via the GPO and then simply create SCOM rules to monitor the event IDs that interest you.

==
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Researcher 11 Reputation points

2022-08-23T06:19:06.78+00:00

"Auditing via the GPO and then create SCOM rules to monitor the event IDs that interest you " - This might be what i am looking for , I will look into this , thanks

Answer 2

Limitless Technology 39,926

Hello,

The Audit in Windows is intended as a record of events for Logon and other information, but not very friendly for daily or individual audit. Mostly useful for repository of data in case of other errors or warnings related to the logon status.

For the purpose that you want to use, would be indeed necessary other 3rd Party tools or AD APIs that allows management on a different interface more dedicated for real time security or comprehensive audit per user.

-------------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept as answer--

Researcher 11 Reputation points

2022-08-23T06:21:10.53+00:00

SCOM by JimmySalian-2011 is one way to go I guess.
Any other 3rd Party tools or AD APIs recommended ?

Share via

How to Get Logs for Authentications of Login and Shared Network access for Domain users in AD Domain Controller.

2 answers

Your answer