Audit on the domain controllers¶

HGPM writes each change it makes to its audit log, and to the log of the system for a SIEM. A change made with another tool (GPMC, samba-tool, a script, an LDAP client) is not in it: the drift shows what changed in a GPO, not who changed it. The domain controllers know who: configure them to say it.

Send them to the SIEM with the events of HGPM: a change of a GPO without its event of HGPM was made with another tool.

Windows (Active Directory)¶

1. The audit policy of the domain controllers¶

In the Default Domain Controllers Policy (the editor of HGPM has it, advanced audit policy): Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies:

On a domain controller, once applied:

auditpol /get /subcategory:"Directory Service Changes","File System"

2. What the directory audits: the SACLs¶

An event is written only for the objects whose SACL audits the change. As a Domain Admin, with the ActiveDirectory module (RSAT), the GPOs and their links:

Import-Module ActiveDirectory
$domain = (Get-ADDomain).DistinguishedName
$everyone = [System.Security.Principal.SecurityIdentifier]'S-1-1-0'
$all = [System.DirectoryServices.ActiveDirectorySecurityInheritance]::All

# The GPOs: created, changed, deleted, their permissions and owner.
$path = "AD:\CN=Policies,CN=System,$domain"
$acl = Get-Acl -Path $path -Audit
$rights = [System.DirectoryServices.ActiveDirectoryRights]'WriteProperty, CreateChild, DeleteChild, Delete, DeleteTree, WriteDacl, WriteOwner'
$acl.AddAuditRule([System.DirectoryServices.ActiveDirectoryAuditRule]::new($everyone, $rights, 'Success', $all))
Set-Acl -Path $path -AclObject $acl

# The links (gPLink) and the block of the inheritance (gPOptions) of the domain and of every OU.
$path = "AD:\$domain"
$acl = Get-Acl -Path $path -Audit
foreach ($attribute in 'f30e3bbe-9ff0-11d1-b603-0000f80367c1', 'f30e3bbf-9ff0-11d1-b603-0000f80367c1') {
    $acl.AddAuditRule([System.DirectoryServices.ActiveDirectoryAuditRule]::new($everyone, 'WriteProperty', 'Success', [guid]$attribute, $all))
}
Set-Acl -Path $path -AclObject $acl

The links of the sites are in the configuration of the forest: the same rule for gPLink on CN=Sites,CN=Configuration,<forest>, as an Enterprise Admin.

3. What SYSVOL audits¶

The SACL of the Policies folder, on each domain controller (SYSVOL is local to each of them):

$path = "$env:SystemRoot\SYSVOL\domain\Policies"
$acl = Get-Acl -Path $path -Audit
$rights = [System.Security.AccessControl.FileSystemRights]'CreateFiles, AppendData, WriteAttributes, WriteExtendedAttributes, DeleteSubdirectoriesAndFiles, Delete, ChangePermissions, TakeOwnership'
$acl.AddAuditRule([System.Security.AccessControl.FileSystemAuditRule]::new('Everyone', $rights, 'ContainerInherit, ObjectInherit', 'None', 'Success'))
Set-Acl -Path $path -AclObject $acl

The events¶

In the Security log of the domain controller where the change was made:

Get-WinEvent -ComputerName dc1 -FilterHashtable @{ LogName = 'Security'; Id = 5136, 5137, 5141 } -MaxEvents 20 |
    Format-List TimeCreated, Id, Message

Samba AD¶

Samba has no SACL: it logs what changes, for every object, as JSON, when the class dsdb_json_audit is at level 5; and the files of a share with the module vfs_full_audit. Both are set in /etc/samba/smb.conf of each domain controller, then Samba is restarted.

1. The changes of the directory¶

In [global]:

[global]
    log level = 0 dsdb_json_audit:5@/var/log/samba/dsdb_json_audit.log

sudo systemctl restart samba-ad-dc

smbcontrol ... debug at run time does not turn it on: the processes of LDAP read it when they start. Other classes, on the same line: dsdb_group_json_audit:5 (the members of the groups: the security filtering groups), auth_json_audit:3 (the logons).

A GPO unlinked from an OU (on one line, shortened here): the value of gPLink before (delete) and after (add), as the console writes it in one request.

{"timestamp": "2026-10-30T12:51:48.701369+0100", "type": "dsdbChange", "dsdbChange": {
  "status": "Success", "operation": "Modify", "remoteAddress": "ipv4:10.0.0.51:47044",
  "userSid": "S-1-5-21-99285962-3314789183-2679996994-500", "dn": "OU=Test,DC=hardenbox,DC=labo",
  "attributes": {"gPLink": {"actions": [
    {"action": "delete", "values": [{"value": "[LDAP://CN={5D5A49E5-...},CN=Policies,...;0][LDAP://CN={04CF011D-...},...;0]"}]},
    {"action": "add", "values": [{"value": "[LDAP://CN={04CF011D-...},CN=Policies,...;0]"}]}]}}}}

The file grows with every change of the domain (logons and computers too): max log size (in kB) rotates it to .old, or a rule of logrotate; the SIEM reads it as JSON.

2. The files of SYSVOL¶

In [sysvol] (and [netlogon]), the module full_audit after the two modules SYSVOL needs:

[sysvol]
    vfs objects = dfs_samba4 acl_xattr full_audit
    full_audit:prefix = IP=%I|USER=%u|MACHINE=%m|VOLUME=%S
    full_audit:success = mkdirat renameat unlinkat pwrite pwrite_send fset_nt_acl
    full_audit:failure = none
    full_audit:facility = local7
    full_audit:priority = NOTICE

Without pwrite_send, unlinkat and fset_nt_acl, the writes of SMB2, the deletions and the permissions are not logged: only the folders renamed are.

Tested¶

On hardenbox.labo (Samba 4.22), the two settings above in smb.conf, Samba restarted, then a GPO created with the console, linked to an OU, unlinked, a permission changed, and deleted:

smbcontrol samba debug and smbcontrol ldap_server debug at run time: nothing logged. With full_audit:success = pwrite write renameat only: the folders renamed only.

The part of Windows gives the settings and the events of Windows Server; it was not run on powershell.labo.