[REQ-DC-138] Audit Policy: Account Management Auditing on Domain Controllers

Target Scope

  • Applicable Systems: Domain Controllers
  • Operating Systems: Windows Server 2016 (and above)

Implementation Details

  • Priority: High
  • GPO Path / Registry Location:
    • GPO Paths: Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies
    • Subcategory: User Account Management -> Success and Failure
    • Subcategory: Security Group Management -> Success and Failure
    • Subcategory: Application Group Management -> Success and Failure
    • Subcategory: Computer Account Management -> Success and Failure
    • Subcategory: Distribution Group Management -> Success
    • Subcategory: Other Account Management Events -> Success and Failure

Rationale

Auditing account management logs security principal modifications (creations, deletions, password resets, group modifications) to detect privilege escalation attempts on domain or local administrative groups.

Legacy Impact & Compatibility

  • Event Log Volume: Verify that the local Security Event Log size is set to a minimum of 1GB on Domain Controllers to prevent rapid log rollover.

Implementation Steps

Option A: Group Policy Object (GPO) Configuration (Preferred)

  1. Configure Advanced Audit Policy subcategory or registry override preferences matching:
    • Subcategory: User Account Management -> Success and Failure
    • Subcategory: Security Group Management -> Success and Failure
    • Subcategory: Application Group Management -> Success and Failure
    • Subcategory: Computer Account Management -> Success and Failure
    • Subcategory: Distribution Group Management -> Success
    • Subcategory: Other Account Management Events -> Success and Failure

Option B: PowerShell & Registry Configuration (Remediation / Non-GPO)

Download Script: Configure-DcAuditAccountmanagement.ps1

# Configure-DcAuditAccountmanagement.ps1
Write-Host "Applying Audit Policy category: account-management..." -ForegroundColor Cyan

# Set Audit Subcategory: User Account Management
$Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"User Account Management`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru
if ($Process.ExitCode -eq 0) {
    Write-Host "    Enforced subcategory User Account Management to Success and Failure" -ForegroundColor Green
} else {
    Write-Error "    Failed to configure subcategory User Account Management. Exit Code: $($Process.ExitCode)"
}

# Set Audit Subcategory: Security Group Management
$Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Security Group Management`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru
if ($Process.ExitCode -eq 0) {
    Write-Host "    Enforced subcategory Security Group Management to Success and Failure" -ForegroundColor Green
} else {
    Write-Error "    Failed to configure subcategory Security Group Management. Exit Code: $($Process.ExitCode)"
}

# Set Audit Subcategory: Application Group Management
$Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Application Group Management`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru
if ($Process.ExitCode -eq 0) {
    Write-Host "    Enforced subcategory Application Group Management to Success and Failure" -ForegroundColor Green
} else {
    Write-Error "    Failed to configure subcategory Application Group Management. Exit Code: $($Process.ExitCode)"
}

# Set Audit Subcategory: Computer Account Management
$Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Computer Account Management`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru
if ($Process.ExitCode -eq 0) {
    Write-Host "    Enforced subcategory Computer Account Management to Success and Failure" -ForegroundColor Green
} else {
    Write-Error "    Failed to configure subcategory Computer Account Management. Exit Code: $($Process.ExitCode)"
}

# Set Audit Subcategory: Distribution Group Management
$Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Distribution Group Management`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru
if ($Process.ExitCode -eq 0) {
    Write-Host "    Enforced subcategory Distribution Group Management to Success" -ForegroundColor Green
} else {
    Write-Error "    Failed to configure subcategory Distribution Group Management. Exit Code: $($Process.ExitCode)"
}

# Set Audit Subcategory: Other Account Management Events
$Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other Account Management Events`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru
if ($Process.ExitCode -eq 0) {
    Write-Host "    Enforced subcategory Other Account Management Events to Success and Failure" -ForegroundColor Green
} else {
    Write-Error "    Failed to configure subcategory Other Account Management Events. Exit Code: $($Process.ExitCode)"
}

To audit the hardening status: Download Script: Get-DcAuditAccountmanagementStatus.ps1

# Get-DcAuditAccountmanagementStatus.ps1
$script:Vulnerable = $false

# Audit Subcategory: User Account Management
$RawOutput = auditpol.exe /get /subcategory:"User Account Management" /r
if ($RawOutput -notmatch ",User Account Management,.*,(Success and Failure|Success & Failure)") {
    $script:Vulnerable = $true
}

# Audit Subcategory: Security Group Management
$RawOutput = auditpol.exe /get /subcategory:"Security Group Management" /r
if ($RawOutput -notmatch ",Security Group Management,.*,(Success and Failure|Success & Failure)") {
    $script:Vulnerable = $true
}

# Audit Subcategory: Application Group Management
$RawOutput = auditpol.exe /get /subcategory:"Application Group Management" /r
if ($RawOutput -notmatch ",Application Group Management,.*,(Success and Failure|Success & Failure)") {
    $script:Vulnerable = $true
}

# Audit Subcategory: Computer Account Management
$RawOutput = auditpol.exe /get /subcategory:"Computer Account Management" /r
if ($RawOutput -notmatch ",Computer Account Management,.*,(Success and Failure|Success & Failure)") {
    $script:Vulnerable = $true
}

# Audit Subcategory: Distribution Group Management
$RawOutput = auditpol.exe /get /subcategory:"Distribution Group Management" /r
if ($RawOutput -notmatch ",Distribution Group Management,.*,Success") {
    $script:Vulnerable = $true
}

# Audit Subcategory: Other Account Management Events
$RawOutput = auditpol.exe /get /subcategory:"Other Account Management Events" /r
if ($RawOutput -notmatch ",Other Account Management Events,.*,(Success and Failure|Success & Failure)") {
    $script:Vulnerable = $true
}

if ($script:Vulnerable) {
    Write-Output "Non-Compliant"
    exit 1
} else {
    Write-Output "Compliant"
    exit 0
}

Sources & Compliance References

  • ANSSI Active Directory Hardening Guide: Recommendation R48
  • CIS Windows Server Benchmark: Section 9 (Audit Policy)

results matching ""

    No results matching ""