Share via

Auditing and verifying privileged account usage in Active Directory?

EnterpriseArchitect 5,016 Reputation points
2023-01-25T00:56:57.3366667+00:00

How can I check if the certain AD user account is still in use or not?

I am in the process of auditing and validating thousands of users across all of these groups:

Domain Admins
Enterprise Admins
Schema Admins
Administrators
Account Operators
DnsAdmins
Backup Operators
Server Management
Server Operators
Organization Management
Exchange Organization Administrators
Enterprise Key Admins
Key Admins

Before I remove or delete the AD account, I wanted to check if there is any other indicator, aside from lastlogondate or lastLogon which sometimes is blank for some unknown reason.

Any event ID or auditing policy in GPO to enable would be greatly appreciated.

Thank you in advance.

Windows
Windows
A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.
4,997 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
6,147 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,774 questions
Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,445 questions
PowerShell
PowerShell
A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
2,272 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Thameur-BOURBITA 32,621 Reputation points
    2023-01-25T01:08:08.6466667+00:00

    Hi,

    You can enable audit through GPO to trace logon and logoff activities.

    I invite you to read the following link for more details:

    Audit Success and Failed Logon Attempts in Active Directory

    Please don't forget to mark helpful answer as accepted

    0 comments
  2. Thameur-BOURBITA 32,621 Reputation points
    2023-01-25T01:49:23.25+00:00

    The majority of events will be recorded in the domain controller where the domain user will be authenticated and other event locally in computer.

    Check GPO settings under Advanced Audit Policy Configuration, you will find many audit option with explanation:

    Advanced Audit Policy Configuration

    Please don't forget to mark helpful answer as accepted

    0 comments