Quick Reference Guide

Group Policy Auditing

How to enable logging of important Group Policy events in security event log

Audit Policy Settings

Run GPMC.msc (url2open.com/gpmc) > open Default Domain Controllers Policy > Computer Configuration > Policies
> Windows Settings > Security Settings:
Advanced Audit Policy Configuration > Audit Policies > Object Access >
Audit File System > Define > Success and Failures
Advanced Audit Policy Configuration > Audit Policies > Object Access >
Audit Handle Manipulation > Define > Success and Failures
Local Policies > Audit Policy > Audit directory service access > Define >
Success and Failures

Object-level GP Auditing

Open ADSI Edit (url2open.com/adsi) > Connect to Default naming context >
DC=domain name > CN=System > right click CN=Policies > Properties >
Security (Tab) > Advanced > Auditing (Tab) > Click Add > Choose the
following settings:
Principal: Everyone; Type: Success; Applies to: This object and all descendant
objects; Permissions: Create groupPolicyContainer objects, Delete
groupPolicyContainer objects > Click OK

Event ID
Reference
(2008-2012)

performed on an object
(Object Type:

Sysvol-level GP Auditing

4662 - An operation was

Navigate to the \\domainname\sysvol\domainfqdn > right-click Policies

folder and select Properties
Select the Security tab > Advanced button > Auditing tab > Click Add
Select Principal: Everyone; Select Type: All; Select Applies to: This folder,
subfolders and files; Select the following Advanced Permissions: Create
files / write data; Create folders / append data; Write attributes; Write
extended attributes; Delete; Delete subfolders and files
Click OK three times
To define what group policy setting was modified filter Event Viewer for
Event ID 4663 and search for Object Name: string, where you can find the
path to policy setting that was changed

groupPolicyContainer)

4663 - Object access attempt

(Task Category: File System)

Security Event Log Settings

Run GPMC.msc > open Default Domain Controllers Policy > Computer
Configuration > Policies > Windows Settings > Security Settings > Event Log >
Define:
Maximum security log size to 1gb
Retention method for security log to Overwrite events as needed
Open Event viewer on any domain controller and search Security log for
event ids listed in the Event ID Reference box

Try Group Policy

Auditing For Free:
netwrix.com/go/trial-ad

For Detailed Group Policy Auditing,

Try Netwrix Auditor netwrix.com/go/trial-ad

Change auditing: detection, reporting and alerting on all configuration changes across your entire IT
infrastructure with Who, What, When, Where details and Before/After values.

Configuration assessment: State-in-time reports show configuration settings at any point in time, such as group
membership or password policy settings as they were configured a year ago.

More than 200 predefined reports, alerts and dashboards with filtering, grouping, sorting, export (PDF, XLS
etc.), email subscriptions, drill-down, access via web, granular permissions and ability to create custom reports.

Long-Term Archiving: scalable two-tiered storage (file-based + SQL database) holding consolidated audit data for
up to and beyond 10 years.

Unified platform to audit the entire IT infrastructure, as opposed to multiple hard-to-integrate standalone tools
from other vendors.

HQ: 8001 Irvine Center Drive,

Phone: 1-949-407-5125

Int'l: 1-949-407-5125

Suite 820, Irvine, CA 92618

Toll-free: 888-638-9749

EMEA: 44 (0) 203-318-0261

netwrix.com/social