SCC Active Directory Audit

SCC.Active.Directory.Audit :: 1.0.0.55 (Management Pack)

• Show Management Pack XML
• Get Management Pack data in Excel format
• Download: SCC.Active.Directory.Audit.xml

Management Pack Elements

Classes (1)

	DisplayName	ID	Base Class	Abstract	Hosted	Singleton	Group	Extension	Accessibility
	Windows 2008 Active Directory Audit Target	SCC.Active.Directory.Audit.Win2008.AuditTarget	Microsoft.Windows.ApplicationComponent	False	True	False	False	False	Internal

Relationship Types (1)

	DisplayName	ID	Source	Target	Accessibility	Abstract
	Windows 2008 DC Hosts Audit Target	SCC.Active.Directory.Audit.Win2008DC.Hosts.AuditTarget	Microsoft.Windows.Server.2008.AD.DomainControllerRole	SCC.Active.Directory.Audit.Win2008.AuditTarget	Internal	False

Discoveries (1)

	DisplayName	ID	Target	Enabled
	Windows 2008 AD Audit Target Discovery	SCC.Active.Directory.Audit.Discover.Win2008AD.AuditTarget	Microsoft.Windows.Server.2008.AD.DomainControllerRole	True

Rules (43)

	DisplayName	ID	Target	Category	Enabled	Alert Generate
	(Security Event ID 4728) - A member was added to a security-enabled global group	SCC.Active.Directory.Audit.AddToGlblSecGrp	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	An Active Directory Site was Created	SCC.Active.Directory.Audit.ADSiteCreated	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	An Active Directory Site was Deleted	SCC.Active.Directory.Audit.ADSiteDeleted	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	An Active Directory Site Link was Created	SCC.Active.Directory.Audit.ADSiteLinkCreated	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	An Active Directory Site Link was Deleted	SCC.Active.Directory.Audit.ADSiteLinkDeleted	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	An Active Directory Site has been Modified	SCC.Active.Directory.Audit.ADSiteModified	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	An Active Directory Subnet was Created	SCC.Active.Directory.Audit.ADSubnetCreated	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	An Active Directory Subnet was Deleted	SCC.Active.Directory.Audit.ADSubnetDeleted	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	An Active Directory Subnet was Modified	SCC.Active.Directory.Audit.ADSubnetModified	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	(Security Event ID 4723) - Change password attempt	SCC.Active.Directory.Audit.ChgPasswordAttempt	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	Collet Account and Group Events (misc 47XX events) (DO NOT ENABLE for development only)	SCC.Active.Directory.Audit.CollectAcctGrpEvents	SCC.Active.Directory.Audit.Win2008.AuditTarget	EventCollection	False	False
	Collect Event 5136: Object Modifications (DO NOT ENABLE development only)	SCC.Active.Directory.Audit.CollEvt5136	SCC.Active.Directory.Audit.Win2008.AuditTarget	EventCollection	False	False
	Collect Event 5136: Object Creation (DO NOT ENABLE development only)	SCC.Active.Directory.Audit.CollEvt5137	SCC.Active.Directory.Audit.Win2008.AuditTarget	EventCollection	False	False
	Collect Event 5139: Object Moved (DO NOT ENABLE development only)	SCC.Active.Directory.Audit.CollEvt5139	SCC.Active.Directory.Audit.Win2008.AuditTarget	EventCollection	False	False
	Collect Event 5141: Object Deleted (DO NOT ENABLE development only)	SCC.Active.Directory.Audit.CollEvt5141	SCC.Active.Directory.Audit.Win2008.AuditTarget	EventCollection	False	False
	(Security Event ID 4727) - A security-enabled global group was created	SCC.Active.Directory.Audit.CreatedGlblSecGrp	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	(Security Event ID 4739) - Domain Policy was changed	SCC.Active.Directory.Audit.DomainPolicyChange	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	(Security Event ID 4730) - A security-enabled global group was deleted	SCC.Active.Directory.Audit.Event4730	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	A Group Policy Object (GPO) has been Created	SCC.Active.Directory.Audit.GPOCreated	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	A Group Policy Object (GPO) was Deleted	SCC.Active.Directory.Audit.GPODeleted	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	A Group Policy Object (GPO) was Modified	SCC.Active.Directory.Audit.GPOModified	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	(Security Event ID 4713) - Kerberos policy was changed	SCC.Active.Directory.Audit.KerbPolChg	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	(Security Event ID 1102) - The audit log was cleared	SCC.Active.Directory.Audit.NewElement	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	An Organizational Unit was Created	SCC.Active.Directory.Audit.OUCreated	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	An Organizational Unit was Deleted	SCC.Active.Directory.Audit.OUDeleted	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	An Organizational Unit was Modified	SCC.Active.Directory.Audit.OUModified	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	An Organizational Unit was Moved	SCC.Active.Directory.Audit.OUMoved	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	(Security Event ID 4729) - A member was removed from a security-enabled global group	SCC.Active.Directory.Audit.RemoveFromGlblSecGrp	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	(Security Event ID 1104) - The security event log was cleared	SCC.Active.Directory.Audit.SecurityLogCleared	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	(Security Event ID 4706) - A new trust was created to a domain	SCC.Active.Directory.Audit.TrustCreated	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	(Security Event ID 4707) - A trust to a domain was removed	SCC.Active.Directory.Audit.TrustRemoved	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	(Security Event ID 4755) - A security-enabled universal group was changed	SCC.Active.Directory.Audit.UnivGrpChanged	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	False	True
	(Security Event ID 4754) - A security-enabled universal group was created	SCC.Active.Directory.Audit.UnivGrpCreated	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	(Security Event ID 4758) - A security-enabled universal group was deleted	SCC.Active.Directory.Audit.UnivGrpDeleted	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	(Security Event ID 4756) - A member was added to a security-enabled universal group	SCC.Active.Directory.Audit.UnivGrpMemAdded	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	(Security Event ID 4757) - A member was removed from a security-enabled universal group	SCC.Active.Directory.Audit.UnivGrpMemRemoved	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	(Security Event ID 4764) - A group’s type was changed	SCC.Active.Directory.Audit.UnivGrpTypeChanged	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	A User Account was Modified	SCC.Active.Directory.Audit.UserAccountChange	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	(Security Event ID 4720) - A User Account was Created	SCC.Active.Directory.Audit.UserAcctCreated	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	(Security Event ID 4726) - A user account was deleted	SCC.Active.Directory.Audit.UserAcctDeleted	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	(Security Event ID 4725) - A user account was disabled	SCC.Active.Directory.Audit.UserAcctDisabled	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	(Security Event ID 4740) - A user account was locked out	SCC.Active.Directory.Audit.UserAcctLockout	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True
	(Security Event ID 4740) - A User Account Password was Set	SCC.Active.Directory.Audit.UserAcctPasswordSet	SCC.Active.Directory.Audit.Win2008.AuditTarget	SecurityHealth	True	True

Agent Tasks (2)

	DisplayName	ID	Target	Accessibility	Category	Enabled
	GPResult	SCC.Active.Directory.Audit.AgentTask.GPResult	SCC.Active.Directory.Audit.Win2008.AuditTarget	Internal	Operations	True
	Get RSoP	SCC.Active.Directory.Audit.ConsoleTask.RSoP	Microsoft.Windows.Computer	Internal	Operations	True

Folder Items (7)

	DisplayName	ID	FolderName	ElementID
	Group Management Alerts	SCC.Active.Directory.Audit.View.GroupManagement	Folder_47ce9f4a0f8f4fd289a89b2a3f6e036a	SCC.Active.Directory.Audit.View.GroupManagement
	Log Management Alerts	SCC.Active.Directory.Audit.View.LogManagement	Folder_47ce9f4a0f8f4fd289a89b2a3f6e036a	SCC.Active.Directory.Audit.View.LogManagement
	OU Management Alerts	SCC.Active.Directory.Audit.View.OUManagement	Folder_47ce9f4a0f8f4fd289a89b2a3f6e036a	SCC.Active.Directory.Audit.View.OUManagement
	Group Policy Management Alerts	SCC.Active.Directory.Audit.View.PolicyManagement	Folder_47ce9f4a0f8f4fd289a89b2a3f6e036a	SCC.Active.Directory.Audit.View.PolicyManagement
	Physical Topology Management	SCC.Active.Directory.Audit.View.SiteManagement	Folder_47ce9f4a0f8f4fd289a89b2a3f6e036a	SCC.Active.Directory.Audit.View.SiteManagement
	User Management Alerts	SCC.Active.Directory.Audit.View.UserManagement	Folder_47ce9f4a0f8f4fd289a89b2a3f6e036a	SCC.Active.Directory.Audit.View.UserManagement
	Audit Events (Collection)	View_8e21fc09df1041ff8a4d0e91c7979508	Folder_47ce9f4a0f8f4fd289a89b2a3f6e036a	View_8e21fc09df1041ff8a4d0e91c7979508

Folders (1)

	DisplayName	ID	ParentFolder	Accessibility
	Active Directory Audit	Folder_47ce9f4a0f8f4fd289a89b2a3f6e036a	Microsoft.SystemCenter.Monitoring.ViewFolder.Root	Public

Views (7)

	DisplayName	ID	Target	Type	Accessibility	Visible
	Group Management Alerts	SCC.Active.Directory.Audit.View.GroupManagement	System.Entity	Microsoft.SystemCenter.AlertViewType	Public	True
	Log Management Alerts	SCC.Active.Directory.Audit.View.LogManagement	System.Entity	Microsoft.SystemCenter.AlertViewType	Public	True
	OU Management Alerts	SCC.Active.Directory.Audit.View.OUManagement	SCC.Active.Directory.Audit.Win2008.AuditTarget	Microsoft.SystemCenter.AlertViewType	Public	True
	Group Policy Management Alerts	SCC.Active.Directory.Audit.View.PolicyManagement	System.Entity	Microsoft.SystemCenter.AlertViewType	Public	True
	Physical Topology Management	SCC.Active.Directory.Audit.View.SiteManagement	System.Entity	Microsoft.SystemCenter.AlertViewType	Public	True
	User Management Alerts	SCC.Active.Directory.Audit.View.UserManagement	System.Entity	Microsoft.SystemCenter.AlertViewType	Public	True
	Audit Events (Collection)	View_8e21fc09df1041ff8a4d0e91c7979508	System.Entity	Microsoft.SystemCenter.EventViewType	Public	True

Linked Reports (1)

	DisplayName	ID	Base	Target	Accessibility	Visible
	Security Audit Alerts	SCC.Active.Directory.Audit.LinkedAlert.Critical	Microsoft.SystemCenter.DataWarehouse.Report.Alert		Internal	True