Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

GPO monitoring

So, I've set up GP monitoring to see when any unauthorized changes are being made without anyone knowing about it. and it's working....sort of.

See I can now see under server configuration summary > recent configuration changes a policy that was modified but the issue is it's not showing the username of the person that made the change.

The owner is the domain admins group, but not the account that was responsible for the change, this isn't much good, any help?

Find more posts tagged with

Comments

Rolfey83

Does no one have any advise? I have checked everything I can think of, I've ensure that the auditing event is being captured by the event viewer, it is, I don't see the point of the monitoring if can't show you changes to things like GPO.

t.m-k

Hi @Rolfey83 ,

It sounds like you are using SCM here? I don't currently have it in my deployment but am in the process of demoing. I don't want to assume you have already read this information so thought it might be helpful in case you haven't: https://documentation.solarwinds.com/en/success_center/scm/content/scm-monitor-who-made-server-configuration-changes.htm

The article contains a table to determine "When is 'who made the change' detection available?" in different scenarios, and then some information further down the page as to why it might not be available in particular scenarios even the conditions mentioned in the table are met. If you have access to SW support then SolarWinds support can also assist if you raise a ticket with them.

I hope this helps and good luck.

--t.m-k

Rolfey83

Thanks, yes I've enabled that setting as I do have it, but unsure where I'm suppose to see the results of any changes made. I'll read that document, thanks.

Rolfey83

So I know I'm replying to myself here, but after a tonne of grief to get it to work, I've got a powershell script that can be used with Solar Winds that will give you al the information about any security group changes, what group, who was added or removed, what time and by whom. the script is below.

############################################################################################################################################################

# Define the XPath query to filter Security group change events (4728 and 4729)
$XPathQuery = @"
*[System[(EventID=4728) or (EventID=4729)]]

# Get the security group change events from the Security log
$events = Get-WinEvent -LogName "Security" -FilterXPath $XPathQuery -ErrorAction SilentlyContinue

# If no events are found, output a message and exit
if ($events.Count -eq 0) {
Write-Host "No further AD security group membership change events found."
return
}

# Process each event
foreach ($event in $events) {
# Extract the relevant details from the event
$timeGenerated = $event.TimeCreated
$eventID = $event.Id

# Extract and parse the event message
$eventMessage = $event.Message

# Extract Subject details
if ($eventMessage -match 'Subject:\s*Security ID:\s*(.*?)\s*Account Name:\s*(.*?)\s*Account Domain:\s*(.*?)\s*Logon ID:\s*(.*?)\s*') {
$subjectSID = $Matches[1]
$subjectAccountName = $Matches[2]
$subjectAccountDomain = $Matches[3]
$subjectLogonID = $Matches[4]
}

# Extract Member details (specifically Member Name)
if ($eventMessage -match 'Member:\s*Security ID:\s*(.*?)\s*Account Name:\s*(CN=.*?)[,]OU=.*?') {
$memberSID = $Matches[1]
$memberAccountName = $Matches[2]
# Cleanup Member Account Name to remove 'CN=' and any trailing '\'
$memberAccountName = $memberAccountName -replace '^CN=', '' -replace '\\$', '' -replace '\\', ''
}

# Extract Group details
if ($eventMessage -match 'Group:\s*Security ID:\s*(.*?)\s*Group Name:\s*(.*?)\s*Group Domain:\s*(.*?)\s*') {
$groupSID = $Matches[1]
$groupName = $Matches[2]
$groupDomain = $Matches[3]
}

# Determine the action based on the Event ID
$action = switch ($eventID) {
4728 { "User added to group" }
4729 { "User removed from group" }
default { "Unknown action" }
}

# Retrieve the Changed By account name based on the Subject Account Name
$changedByAccount = $subjectAccountName

# Format the output
Write-Host "Time: $timeGenerated"
Write-Host "Event ID: $eventID"
Write-Host "Member Name: $memberAccountName"
Write-Host "Action: $action"
Write-Host "Group Name: $groupName"
Write-Host "Group Domain: $groupDomain"
Write-Host "Changed By: $changedByAccount"
Write-Host "------------------------------------------------"
}

This can be used with Server configuration monitor, I hope it helps people out. please move this to the correct place.

One thing I notice, the results of this script, while seem to work perfectly well in the monitor view, when you run a report, it's not captured.

tobyw_loop1

Thanks for sharing with the community. You can share the PS1 file directly in the content exchange here Scripts or upload the entire SAM template here Application Monitor Templates

donrobert5

Best advice

kpina

Agreed! @Rolfey83 , the content exchange is the best place for this, then you can post a link to your contribution in the SCM forum for all to find.