Security Compliance
Monitor Active Directory events with SEM
This article provides information for when you want to use SEM to monitor Active Directory events, such as user account creates/deletes, security group creates/deletes, user logons or logon failures, etc.
First published date
11/29/2018 10:33 PM
Last published date
11/29/2018 10:33 PM
Overview
This article provides information for when you want to use Security Event Manager (formerly Log & Event Manager) to monitor Active Directory events, such as user account creates/deletes, security group creates/deletes, user logons or logon failures, etc.
Product section
Security Event Manager
Resolution
- Verify that your auditing policy is configured to create these events. Refer to the table below and see Audit Policies and Best Practices for SEM. Refer to the table below to identify which event type you should search for using nDepth.
- Search nDepth to verify those events are being logged as expected. Once they are found in nDepth, you can use those event details to create a rule to monitor them, if desired.
| Description | Event Type | Windows Event ID / ProviderSID field in SEM | Audit Policy Category / Subcategory | Corresponding Rule |
| Group member added to security group | NewGroupMember | 4728 | Account Management / Security Group Management |
User Added to Group New Critical Group Member |
| Group member removed from security group | DeleteGroupMember | 4729 | Account Management / Security Group Management | User Removed from Group |
| User account created | NewDomainMember | 4720 | Account Management / User Account Management | User Account Created |
| User account deleted | DeleteDomainMember | 4726 | Account Management / User Account Management | User Account Deleted |
| User account enabled | UserEnable | 4722 | Account Management / User Account Management | User Account Enabled |
| User account disabled | UserDisable | 4725 | Account Management / User Account Management | User Account Disabled |
| Account lockout | UserDisable | 4740 | Logon/Logoff / Account Lockout | User Account Lockout |
| GPO/AD Object Change | ObjectAudit | 5136 | Directory Service / Directory Service Changes | N/A |