In this article:

• Objective

• Prerequisites

• Steps to follow

• Validation and confirmation

• Tips

• Related topics and articles

Objective  

This article explains how to enable auditing to capture modifications related to Group Managed Service Accounts (gMSAs) in Active Directory. It details the required auditing policies and configurations to track changes.

Prerequisites  

• Have administrative privileges to modify Group Policy and Active Directory permissions.

• Have domain administrator or equivalent privileges.

• Have access to Group Policy Management and Active Directory Users and Computers (ADUC).

Steps to follow

Step 1: Enable advanced auditing policies  

1. Log in to the primary domain controller.

2. Open the Group Policy Management Editor by typing gpedit.msc in the Run dialog box.

3. Navigate to:

• Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > DS Access.

4. Locate Audit Directory Service Changes and enable both Success and Failure.

5. Click Apply and OK.

Step 2: Set system access control lists for auditing  

1. Log in to the primary domain controller.

2. Open ADUC by typing dsa.msc in the Run dialog on the domain controller.

3. Right-click the domain and select Properties.

4. Navigate to the Security tab and click Advanced.

5. Switch to the Auditing tab and click Add.

6. In the Select Principal field, enter Everyone.

7. Set Type to Success.

8. In Apply onto, select This object and all descendant objects.

Step 3: Configure permissions for gMSA auditing  

1. Under Permissions to enable, select:

• Create msDS-GroupManagedServiceAccount objects (or Create all child objects).

• Delete msDS-GroupManagedServiceAccount objects (or Delete all child objects).

2. To monitor modifications to gMSA attributes:

• Set Apply onto: Descendant msDS-GroupManagedServiceAccount objects.

• Enable the following permissions:

• Write All Properties

• Delete

• Modify Permissions

3. Click Apply and OK to save changes.

Validation and confirmation  

• Check Event Viewer > Security Logs for event ID 5136 (directory service changes).

• Verify that modifications to gMSA accounts generate audit entries.

• Test by modifying a gMSA attribute and confirming log entries.

Tips

• Regularly review audit policies to ensure security compliance.

• Configure alerts in ADAudit Plus to detect unauthorized modifications.

Related Topics and Articles  

• How to create an alert when a gMSA is created