In addition to setting categories as configured/unconfigured an administrator can also choose if success, failure, or both will be logged. There is a benefit to both because a successful login from a previously non-privileged account can indicate privilege escalation by a nefarious actor, and a high number of failures indicate an ongoing brute-force attempt.

Turning on audit logging for all systems is a good idea. Note that audit logging needs to be enabled on domain controllers for accountability since they will allow or deny directory actions, authentications, Kerberos tickets, account changes, and user logins.  Audit logs are stored as events in Windows Event Logs and can be viewed remotely or on the local system in the Windows Event Viewer.

The built-in audit logging is a good start, but Microsoft Sysinternals provides a well-tested add-on tool called Sysmon that amplifies built-in audit logging capabilities.

Sysmon expands Windows audit logging capabilities to provide visibility into network connections, process creation, and file system changes. Sysmon also helps identify indicators of compromise or gives an administrator the foundation to contain or even stop compromises before they happen. In the event of an actual breach, Sysmon provides vital information for incident response and identifying the source and extent of the compromise.  

The main challenge with Sysmon and with Windows event logging in general is they are reactive tools that do not proactively enable organizations to mitigate risks. Because Windows event logs aren’t correlated in any way, there is no alerting or pattern recognition built in.

To be effective, a third-party SIEM tool is a must-have. One that can ingest and normalize all the audit logs including those gleaned from Sysmon to identify irregular patterns, determine potential signs of compromise, and alert an administrator on critical events without bombarding with false positives.

With Cayosoft Administrator and Guardian, additional audit logging from AD isn’t even necessary because the platforms don’t rely on event logs. Event logs are typically configured to roll over so quickly that even a SIEM will not pick them up and store them. Guardian though captures events with easy, clear, and concise information and can alert. Anything captured in Guardian can also become a report and be emailed or sent to collaboration channels. This event capture setup gives Guardian the capability to do a single click rollback of unwanted changes at the attribute level. Rollbacks can be automated to protect sensitive objects in hybrid environments from unapproved changes such as conditional access policies, roles, GPO’s etc.

In addition, Guardian offers a threat module that is 100% ready to go out of the box and requires zero config. The module can not only conduct scans on schedules, but can also audit changes to determine if they pose a threat and can produce real-time alerts based on this audit monitoring.

Besides Guardian’s report generation capabilities, Cayosoft Administrator also logs changes made by admins in detail and can generate scheduled reports. Administrator can also use the information it receives to perform automated environment clean-ups. For example, Cayosoft Administrator can find disabled users that are older than a certain time frame and perform any action needed like moving to an “Inactive” OU, removing attributes and groups, or deleting. Depending on the circumstances, it can also look for unoptimized Microsoft license usage and make recommendations for license downgrade or upgrade.