Forum Discussion

StuartH .'s avatar
StuartH .
Brass Contributor
Jan 26, 2018

Sensitive groups

Has anyone managed to get anything meaningful from Sensitive Groups ?  I thought the intent was to "monitor" those groups for membership changes.  I have pushed and pulled users in and out of groups ...
Gerson Levitz's avatar
Gerson Levitz
Iron Contributor
Jan 28, 2018

Hi Stuart, 

 

There is a report that will show you all of the sensitive group modifications. Can you run this report and see if it has the modifications you did recently? 

 

Thanks

Gershon

  • StuartH .'s avatar
    StuartH .
    Brass Contributor
    Jan 28, 2018

    The group in question (as a test) was not one that normally gets modified at all....in fact it has probably not been modified for 12 months, by anyone previously.

     

    Yes, was aware of the report.....and there is NOTHING at all in the report, which actually would be more useful to me than a console alert.  Why would it not show in the report ?  Yes, auditing for group membership is nabbed, and yes, it shows on the event log.

    • EliOfek's avatar
      EliOfek
      Icon for Microsoft rankMicrosoft
      Jan 28, 2018

      Which domain group was it?

      Keep in mind that in 1.8.* we are using a closed list of groups defined as sensitive.

      in future version you will be able to tag yourself which groups are sensitive for you.

      • StuartH .'s avatar
        StuartH .
        Brass Contributor
        Jan 28, 2018
        ?? But we are talking ATP here, not ATA. There is already a list of sensitive groups that you can choose to "monitor", and whilst I have added things like Domain Admins and Enterprise Admins (which get changed very infrequently), I added a test group so we could see that the report and behaviour was like. Whilst I have not tried removing or adding folks to DA and EA (our auditors would not be happy with that, and I am not about to raise a change record just for that), it should certainly evaluate the group I have added, surely ?

Resources