Every organization needs to set up automated monitoring of Active Directory membership changes. Even business leaders who are “non-technical” have heard of Microsoft’s Active Directory. It’s the database that connects all of your employees with the network resources they need to get work done. And it should be a highly guarded asset in your security team’s care.
Why Is Active Directory So Important?
Active Directory contains information critical to the day-to-day operations of your business. Some of the data points include user names, job titles, phone numbers, passwords, and permissions for network and device activity.
It also manages the authentication of users: verifying that Jim in accounting is really Jim in accounting when he logs on to his laptop and starts accessing financial documents on the company server.
Why Monitor Active Directory Memberships?
Every change in membership represents a potential exposure to risk. Linking a new user, new device, or new administrator to your network should be a carefully monitored event.
The principle of least privilege should be considered whenever a membership is created. A hacker gaining access to your Active Directory through a user or device (or, worst of all, an admin account) could undermine the entire foundation of your company’s IT systems.
How to Create an Alert
The correct stance in IT security is a proactive one. You should assume that your Active Directory is a target and create automated alerts for any time a user is added to an administrator group. Admin group changes should not happen frequently so it will be easy to spot anything out of the ordinary.
We defer to the great advice of Adam Bertram in this article for MCP Mag. He outlines the details of creating the script and keeps things simple and brief.
Do you need help securing your Active Directory or creating automated alerts? Asylas is available to assist you. Call us at 615-622-4591 or email info@asylas.com. Or complete our contact form.
