The following events will be appear in logs when enabled:Īn Active Directory replica source naming context was established.Īn Active Directory replica source naming context was removed.Īn Active Directory replica source naming context was modified.Īn Active Directory replica destination naming context was modified.Īttributes of an Active Directory object were replicated.Ī lingering object was removed from a replica. This audit subcategory can be useful to diagnose replication issues.

Audit Detailed Directory Service Replication: This security policy setting can be used to generate security audit events with detailed tracking information about the data that is replicated between domain controllers.

There are 4 subcategories found under DS Access. Go to Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > DS Access

Right-click on Default Domain Controllers Policy and select Edit.

Load Group policy management editor using Server Manager > Tools > Group Policy Management.

This can be enabled via the Default Domain Controllers Policy found within AD.įirst lets enable this GPO setting. This post uses Active Directory offered via Windows Server 2016. Therefore the policy should only target the Domain Controllers. Advanced Security Audit Policy also needs to be enable via GPO. This post will specifically focus on the DS Access category which is focused on Active Directory Access and Object Modifications. Advanced Security Audit Policy provides 53 options to tune up auditing requirements and the ability to collect more granular level information about infrastructure events. Microsoft understands these modern requirements and with the introduction of Advanced Security Audit Policy first offered in Windows 2008 R2. Security threats are changing every day and sometimes the default event logs may not be enough to help to answer what has gone wrong.

Preventing any unauthorized access and unplanned changes in an AD environment should be top of mind for any system administrator. Even small changes with in an Organization’s AD can cause a major business impact. Active directory is one of the more impactful services from a security perspective within an organization.

Active directory ds