Auditing the Creation of Domain Controllers
Special thanks to Raman in the Active Directory team for this one.
Ever want to audit the creation of new domain controllers in your environment? Yeah, me neither :-) However if you ever want to, here's how.
1. The default SACL on Active Directory should suffice. However, if you have changed the default SACL, here it is again, in SDDL:
S:(AU;SA;WDWOWP;;;WD)
(AU;SA;CR;;;BA)
(AU;SA;CR;;;DU) <-- this ACE is probably doing most of the work for you
(OU;CISA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)
(OU;CISA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)
2. Enable DS Access audit policy for success events in the Default Domain Controllers policy.
3. Look for the following event 566 in your security event log (yours will differ slightly because this example comes from Longhorn Server):
An operation was performed on an object.
Subject :
Security ID: YOURDOMAIN\Administrator
Account Name: Administrator
Account Domain: YOURDOMAIN
Logon ID: 0x201d29
Object:
Object Server: DS
Object Type: domainDNS
Object Name: DC=yourdomain,DC=com
Handle ID: 0x0
Operation:
Operation Type: Object Access
Accesses: Control Access
Access Mask: 0x100
Properties: Control Access
{9923a32a-3607-11d2-b9be-0000f87a36b2} <-- this is the "DS-Install-Replica" control access right
domainDNS
Additional Information:
Parameter 1: -
Parameter 2:
Some notes:
1. There is no audit generated for the first domain controller in a new forest (there is no context within which to perform DS audting).
2. For the first domain controller in a new domain in an existing forest, you'll see a slightly different event:
DS Access: (here's the Longhorn version of the DS Access event, the Windows Server 2003 version [566] is very similar):
An operation was performed on an object.
Subject :
Security ID: MYDOMAIN\Administrator
Account Name: Administrator
Account Domain: MYDOMAIN
Logon ID: 0x3213d7
Object:
Object Server: DS
Object Type: crossRefContainer <-- when you see this
Object Name: CN=Partitions,CN=Configuration,DC=mydomain,DC=com
Handle ID: 0x0
Operation:
Operation Type: Object Access
Accesses: Create Child
Access Mask: 0x1
Properties: Create Child
{bf967a8d-0de6-11d0-a285-00aa003049e2}
Additional Information:
Parameter 1: CN=NEWDOMAIN,CN=Partitions,CN=Configuration,DC=mydomain,DC=com
^-- along with a new domain for the first time
Parameter 2: CN=NEWDOMAIN,CN=Partitions,CN=Configuration,DC=mydomain,DC=com
DS Change: (this is the new Longhorn-only DS Change event):
A directory service object was created.
Subject:
Security ID: MYDOMAIN\Administrator
Account Name: Administrator
Account Domain: MYDOMAIN
Logon ID: 0x3213d7
Directory Service:
Name: mydomain.nttest.microsoft.com
Type: Active Directory Domain Services
Object:
DN: CN=NEWDOMAIN,CN=Partitions,CN=Configuration,DC=mydomain,DC=com
GUID: CN=NEWDOMAIN,CN=Partitions,CN=Configuration,DC=mydomain, DC=com
Class: crossRef
Operation:
Correlation ID: {a991c256-d7f2-4654-bf68-76ef5ebe69b4}
Application Correlation ID: -
HTH