Audit Active Directory using SAM

[mlathamuk]

Can you audit Active Directory using SAM?

i.e. Account changes, logins etc.

[jpr7311]

Sure can, and its not painful to configure either because it is a built-in SAM template called "Windows Server 2008-2012 Domain Controller Security".  Simply apply that template to your DC's.  Below is a screenshot of the components included in this application template:

[torquenut]

Are there some obvious "next steps" that I have overlooked implementing this template?  The most alerting I am receiving is in the active alerts pane.  I would like to configure the alert to email me the Windows event detail (e.g., "User John.Smith is locked out" or "Admin Joe.Person attempted to change the password of User Randy.Random"),

This is what I'm getting currently:

Thanks!

[mprobus]

SAM doesn't give you the details of what occurred.  SAM is used for a statistical measure to let you know how many times the event occurred.  To get the details of the event log, you would need something like LEM.

[mesverrum]

Actually you can pull the details of the windows event(s) that trigger the alert, I usually add these to my email messages because they can be a little verbose for showing on the event list.

To add that variable to the email reference this variable in the message:

${N=SwisEntity;M=ComponentAlert.WindowsEventMessages}

-Marc Netterfield

    Loop1 Systems: SolarWinds Training and Professional Services

•                 LinkedIN: Loop1 Systems
•                 Facebook: Loop1 Systems
•                 Twitter: @Loop1Systems

[mprobus]

Thanks.  Good to know.