Announcement

Collapse
No announcement yet.

Anyway to see when AD changes where made?

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Anyway to see when AD changes where made?

    I have googled this, but I can not find anything, but there has to be a way.

    I have a site that has been hacked a few times, and I would like to know if they made any changes in AD. Is there anyway to gen a list of all changes, orderd by change date?

    Wofen
    Good to be back....

  • #2
    Re: Anyway to see when AD changes where made?

    only if it's previously enabled sorry champ
    Please do show your appreciation to those who assist you by leaving Rep Point https://www.petri.com/forums/core/im.../icon_beer.gif

    Comment


    • #3
      Re: Anyway to see when AD changes where made?

      Originally posted by tehcamel View Post
      only if it's previously enabled sorry champ

      How do I apply it...
      And do you just mean the event logging? As thats almost usless.

      Wofen
      Good to be back....

      Comment


      • #4
        Re: Anyway to see when AD changes where made?

        try some of these for ideas
        http://technet.microsoft.com/en-us/l...8WS.10%29.aspx
        http://www.windowsecurity.com/articl...-Auditing.html
        http://support.microsoft.com/kb/814595

        Auditing generates ALOT of data though. - maybe run it off to a SQL Server if you can rather than local event logs
        Please do show your appreciation to those who assist you by leaving Rep Point https://www.petri.com/forums/core/im.../icon_beer.gif

        Comment

        Working...
        X