MIM User and Group membership snaps

Question

Hi,
I'm just wondering is it possible to make historical snaps for MIM with AD group membership?

We have DB where we are keeping the desired state for users. So we know that user1 must be a member of Group1.
If the user1 will be a member of Group2 this should be threatened as a security alert and the user must be removed from Group2. That could be done by MIM.

But if we want to track such changes and make something like historical snaps with user-group membership information for the security investigations? How it could be done?

Thanks.

Answer 1

Hi,
By using Audit Group Membership, you can audit group memberships when they're enumerated on the client computer.
Under the computer configuration,

https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-group-membership

Answer 2

Hi,
 
Just want to confirm the current situations.
If there's anything you'd like to know, don't hesitate to ask.

Best Regards,

Answer 3

Hi, thanks for the answer.
I was trying to do that with MIM, but this would be good option.