Forum Discussion
Advanced Threat Analytics
I am looking for a solution that will notify management whenever a domain admin performs a task. I am not looking for when an DA logs on/off but actually performs an elevated task. For example: Run...
You would need a SEIM tool or look at WEFFLES by Jessica Payne. Running ADUC from a workstation won't be captured on a DC but the actions (edit, disable, create) should be if your auditing is done right. Don't forget as well as setting the audit policy GPO, you have to configure the auditing in the SACL
