Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Message center auditing an Active directory group

I am working with the orion message center to figure out who made changes to a "Windows Groups" account. Someone gave the account admin rights and shouldn't have. If I put my user in the "User" field it pulls up all the changes I made today, but when I do the same search with the group, I get no results. I know that users in this group made changes.

Is there anyway to search the audit logs with Message Center to audit the AD group? I don't think it would be feasible to audit each user individually.

Find more posts tagged with

Accepted answers

All comments

aLTeReGo

Was the change was made from within Orion? Have you have configured auditing for group membership changes in windows and are using either the Windows Event Log Forwarder or Log Manager to collect those events? What are your retention settings for Syslog and other Log data in Orion?

ed.selig

Yes the change was madein Orion. It was a change to the permissions the account has in SolarWinds. I am specifically looking at Message center. As you probably know Message center audits changes in Orion. If it was an individual user I would be able to enter the user name and it would show exactly what the user has done in Orion in the determined time. What I am trying to figure out is if there a way to audit this information by group. I am not looking at purchasing log manager or configuring windows event log forwarder. I think retention is one year so there should be no problem finding changes that happened this week.

aLTeReGo

From my own testing of 2020.2.5, it seems the creation/addition of the Group in Orion is Audited successfully, but modifications to those group permissions are not. I have logged this internally under CORE-17147