Auditing Group access in NT4 1

[Ulaa]

Recently a problem has come up where persons are ending up in groups that they shouldnt be in and they are getting access to priviledged information. This has now occurred twice in the last two weeks.
Someone somewhere is adding to groups with no understanding of the consequences.

Now we currently have approx 22 Domain Admins (no we cant chop it further) and 7 account operators. When asked everyone throws their hands in the air and shouts to the heavens that they didnt do it.

I have enabled Auditing and turned on "User and Group Management" and "Use of User rights" with success and failure. However when checking the security Logs this is not Giving me the information I need.

After a Peruse of NT FAQ (NTFAQ/Security16.html "How do I enable Auditing on the SAM&quot I attempted to enable auditing on the SAM and SECURITY keys in HKEY_LOCAL_MACHINE. However the method that is suggested will not work on our servers and it fails with an "Unable to initialise DLL" error as it is trying to Access "C:\WINNT\SYSTEM32\kernel32.dll" which the server has locked up tight.

The following is the method described in NT FAQ.
First ensure auditing is enabled on the system using User Manager - Policies menu - Audit.
Select the "Audit These Events". Choose the objects to audit and click OK.
Next make sure the Scheduler service is running on the machine either via the Services Control Panel applet (Start - Settings - Control Panel - Services) or type "net start" and look for "Scheduler". If it is not running you can start by typing
C:\> net start schedule
At the command prompt (cmd.exe) type
C:\> at <time> /interactive &quot;regedt32.exe&quot;
where <time> is a minute in the future.

This works ok right up to the moment the scheduler attempts to open at which time it fails with the error mentioned above.

I have attempted to try the FAQ method on workstations and it works fine, but it failed on the 4 servers I tried it on. The workstation security logs in fact gave me exactly the information I needed after I had turned on Auditing in the registry.

Now the problem ultimately is this:
I need a Tool that will give me detailed information on Groups and Group movements:

IE: &quot;User John Smith has been added to group ADMINS by Backup Operator Lisa Jones&quot;.

I am happy to pay a reasonable amount for such a tool if there is one available. I have Checked NT4RK and NT FAQ with no success.

If anyone can suggest either a good tool or a way to get the NT FAQ method above to actually work I would be very grateful.
Our Domain is Mixed NT4/SP5 and Win2k/SP1

 

[Ulaa]

Any Ideas?

 

[Mubashir]

Interesting....

I marked your thread a few days back but couldn't post due to lack of time. Now that I'm leaving for the weekend, I have sometime of my own...

I think you need to understand auditing for the entire domain. The NT FAQ you are referring to will only work in NT workstations and standalone servers with local SAMs.

When you enable auditing in the &quot;User Manager for Domains&quot; and check Success or Failure for any event, it is meant for the entire domain. A domain has a central SAM which resides on the PDC and its backup copy resides on the BDC. When any any of the event is triggered an entry is logged on the Security Logs of the domain controllers. To which domain controller any particular event is logged depends upon the nature of the event. For instance, &quot;Logon and Logoff&quot; events are logged on the DC authenticating the user. Likewise the &quot;File and Object Access&quot; events are logged on the DCs where files and resources are located.

The case of &quot;User and Group Management&quot; and &quot;Security Policy Changes&quot; is different as they relate to the domain SAM which is central and lies on the PDC. All activity on these events is logged on the PDC, and not on the domain controller the activity takes place.

If you wish to see changes made to user and group accounts, you'll have to check the Security Log of the PDC, provided you've enabled auditing on &quot;User and Group Management&quot;.

Now here's how to translate the Security Log of the PDC and get the information you want. If you suspect anyone from the administrators or account operators group is fiddling with the groups and creating problems, look for Event ID 641 for changes made to the global group accounts and Event ID 639 for local group accounts.

Below is a list of events which will be helpful for you:

Event ID Description
631 Global group created
641 Global group changed
632 Global group member added
633 Global group member removed

639 Local group changed
636 Local group member added
637 Local group member removed

And if you see the details of the events I'm sure you can analyse the info and catch the culprit. There's a lot of useful info for each of the above events like; target domain, target account name, the member added or removed, caller user name (the culprit) in addition to time, date etc.

One interesting fact is that the usernames added or removed from the local or global groups are identified by their SIDs instead of the actual usernames. You can convert a SID into username and back, don't you? But then it's a different ballgame altogather. Anyway, we are trying to nab the hitmen not the target, isn't it? ;-) Go on filter these events and settle the issue. Just let me know when you've done it.

So you don't have to do anything to the registry or buy a tool for monitoring group management. Some solutions for NT problems are built into it, just lying there to be explored.

Hope this helps.

Mubashir
muhammad.mubashir@sbp.org.pk

 

[Ulaa]

Mubashir,
Thank you very much. This is exactly what I was looking for, some method of getting details on what the Auditing was actually doing and you have explained it brilliantly. Thank you.
I did Know how SAMs and PDC/BDC logging worked (I somehow managed to pass a couple of Microsoft exams ) but your info on auditing and the Event ID types was excellent and exactly what I was looking for.

I will keep playing with the logs and the event Ids.

Once again Tek-Tips comes through!!