40. Applying Auditing Policy

 Applying Auditing Policy

A computer running windows 2012 server Domain Controller.

A member server running windows server 2012 or Client running windows 7.

SYS1                                                                         SYS2

Domain Controller                                                 Member Server / Client

IP Address            10.0.0.1                                     IP Address            10.0.0.2

Subnet Mask         255.0.0.0                                  Subnet Mask         255.0.0.0

Preferred DNS      10.0.0.1                                     Preferred DNS    10.0.0.1

Steps:

1. Press windows Key to go to Start, select Group Policy Managament.

2. Right click Domain Controllers -> select Create a GPO...

3. Enter name (Ex: Auditing User Account Management) and click OK.

4. Right Click created GPO, select Edit.

5. Expand User configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Aduit Policy Configuriation -> Aduit Policies -> Account Management -> Right click Audit User Account Management -> Select Properties

6. Check the box, Configure the following aduit events and Select Success and Failure.

Verification:

1. Login as Administrator on D.C, go to Active Directory Users and Computers and delete a user (S1).

2. Go to Start, Type Event in Search Apps and select Event Viewer

3. Expand Windows Logs -> Security and select the Event Audit Success Properties.

4. Verify the event displaying user s1 deleted by Administrator.Management