Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

How to use Solar Winds logging to see when Security groups have been deleted and by who.

I've managed to capture when people are added to and removed from security groups using server configuration changes, this is great for a quick view for something that happened in the last day or 2, but I want to find out when a security group was actually deleted and by whom.

Any guidance on how to achieve this, I guess logging is the best option?

Find more posts tagged with

Accepted answers

itengineer

Hi @Rolfey83 ,
Yes, you can.

But you will need to enable these events logging firstly:

4730: A security-enabled global group was deleted.
4734: A security-enabled local group was deleted.
4758: A security-enabled universal group was deleted.

Edit the GPO or create one:

Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> Audit Policies -> Account Management.

Find and enable the following policies:

Audit Security Group Management
Audit Distribution Group Management<br />

Double-click on each policy and check both “Success” and “Failure” to ensure all relevant events are logged.

Then, configure the Event Monitoring using : https://documentation.solarwinds.com/en/success_center/sam/content/sam-windows-event-log-monitor-sw3329.htm

Hope this helps.

All comments

itengineer

Hi @Rolfey83 ,
Yes, you can.

But you will need to enable these events logging firstly:

4730: A security-enabled global group was deleted.
4734: A security-enabled local group was deleted.
4758: A security-enabled universal group was deleted.

Edit the GPO or create one:

Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> Audit Policies -> Account Management.

Find and enable the following policies:

Audit Security Group Management
Audit Distribution Group Management<br />

Double-click on each policy and check both “Success” and “Failure” to ensure all relevant events are logged.

Then, configure the Event Monitoring using : https://documentation.solarwinds.com/en/success_center/sam/content/sam-windows-event-log-monitor-sw3329.htm

Hope this helps.

Rolfey83

That's cool, I've already enabled Audit logging on our DC's this is how I'm able to track additions and removals to security groups with server configuration summary, however I've not easily been able to track the removal of a security group removal. I'm pretty new to SW and also the logging tool. I guess it should be straight forward but sometimes it's not quite a straight forward as you thought

mark.gover

Alternatively - Manage Engine's ADAudit Plus is specifically designed for this purpose. https://www.manageengine.com/products/active-directory-audit/