Monitor Domain Groups

We have been using a product called GFI, and we are looking to replace it with SolarWinds SAM. One of the things GFI does is monitor Domain Groups. We can tell it that if any user besides the ones specified are added to a certain group (ex. Domain Admins) to send an alert. Does Orion SAM have the capability of doing something like this. The same applies for local admin accounts, we would like to be notified if users are added to this group on our servers.

Thanks for the help!,

Find more posts tagged with

domain_groups

domain_admin

account_monitoring

Accepted answers

aLTeReGo

SAM was designed to monitor the status, health and performance of applications such as Active Directory. Monitoring group membership is not something that would fall into these categories. However, SAM is an extremely flexible product so while we may not provide an out-of-the-box application template this may be possible creating your own custom application template using either the LDAP User Experience monitor or the Windows Event log monitor. For example the LDAP User Experiance monitor could validate a user is a member of a specific group. You could also use the Windows Event Log monitor to monitor the Domain Controllers audit logs for changes to group membership. You could even write your own PowerShell script monitor to validate active directory objects. These are just a few options available.

All comments

aLTeReGo

jspanitz

We need this functionality OOB as well. We used to do this via SCOM and need to figure out a way to do it in SAM.

lhhkarim

Thanks for the information, I decided to just monitor the groups using the windows event logs as you suggested and use traps. If there is a change I now receive an alert notifiying me of the event.

lhhkarim

We used the trap viewer to setup alerts based on security events from the windows event logs. When there is a change in one of the global security groups an alert is sent. We used event id 632 as the trap sent to Orion.

robertcbrowning

Hi, we need the same functionality and particularly for local admin accounts. Watching for events would certainly catch accounts in use, but not the unused backdoor admin accounts that have been forgotten and are now unknown to all current staff.

Did anyone create a PS script or SAM template for this?

Hopefully,

Robert