Protecting And Auditing Active Directory With Quest Solutions

Architectural Limitations of the Native Active Directory Audit LogBecause Active Directory monitoring and auditing is so important, Windows Server providessome native functionality for auditing changes and other high-priority AD events. Despite thevaluable functionality provided by the Windows security log, significant gaps and limitationsremain. The following limitations compromise an organization’s ability to fulfill security andregulatory requirements for monitoring and auditing Active Directory:Audit data scattered among domain controllers - While directory information isreplicated between domain controllers, security logs are not. Each domain controller hasits own security log, which contains only the events associated with operationsperformed against that particular domain controller. Therefore, an organization’s overallaudit trail is fragmented across many domain controllers within the AD environment.No reporting or alerting - Windows Server provides no real reporting or analysiscapabilities for the Windows security log. The one native tool for viewing security logactivity is the Event Viewer Microsoft Management Console, which provides only basicfiltering capabilities. The task triggering capability introduced in Windows Server 2008could provide some rudimentary alerting but would require significant scripting andmanagement effort.No protection from administrators – Since the audit data remains on the domaincontrollers, it cannot be used as a reliable audit trail of administrator actions becauseadministrators can erase or modify any file on the system.High volume of audit data - Because of the low-level, generalized nature of theDirectory Service Access category, the Windows security log can produce hugeamounts of data when used to audit AD changes. With each domain controllerproducing potentially hundreds of megabytes of audit data every day, locating criticalevents is like looking for a needle in a haystack—and vast storage is required to archivethe audit data.Performance risks - Given the huge amounts of audit data and the arcane nature ofpolicy definition, it is easy to define AD audit policies that may overwhelm any amount ofdomain controller hardware.For a full discussion of AD’s native audit log, its limitations and impact on compliance with keyregulatory requirements please see the white paper ―Overcoming Active Directory Audit LogLimitations‖ available at estdefid 26188.Real-Time MonitoringProtecting Active Directory requires real-time monitoring that identifies high impact, suspicious orprohibited changes and automatically takes appropriate actions, such as reversing the change orinforming appropriate personnel.Alerting – Administrators need to be able to define changes that may not necessarily beprohibited but are suspicious or high- impact. These changes need to be reviewed immediately todetermine an appropriate response. For instance, when a group policy object is modified,potentially thousands of computers or users could be impacted. At the same time, oncestabilized, most GPOs are fairly static and seldom need modification. Therefore, administratorsshould be able to designate stable GPOs and receive immediate notification of any modifications.Upon such notification, administrators can confirm that the GPO change was approved andexecuted in compliance with the organization’s normal configuration change control process.Technical Brief: Protecting and Auditing Active Directory with Quest Solutions6

Integration with system management solutions - While direct e-mail notification may beappropriate in some situations, enterprises need the ability to receive alerts generated by ADmonitoring directly into systems management solutions such as System Center OperationsManager (SCOM) or Tivoli via SNMP traps or other interfaces.Object protection – Some changes should not be allowed at all. For instance, administratorsmay create an organizational unit (OU) that holds critical objects intended for emergencies, ThisOU may contain an emergency administrator account to be used if all other administratoraccounts are deleted, locked out or unavailable, possibly due to a denial of service attach. Or atop level group policy object may ensure certain critical security policies are deployed to allcomputers. In both cases, an organization needs the ability to lock down such objects to preventany modification that could jeopardize their purpose – even by administrators.ReportingMost AD changes are not severe enough to generate an alert or object protection response, but neededto be reported. Organizations need to report Active Directory changes to fulfill a wide array of analyticaland documentation needs, including:Planning and analysis – Because enterprises are constantly changing, they need to be able toanalyze historical data to predict future capacity requirements. They also need to determine howfrequently certain changes are made to assess the benefit of automating certain processes or theimpact of modifying an operation. For instance, an organization considering adopting a selfservice password reset solution needs to know how often accounts are locked out due toforgotten passwords and how many corresponding calls are made to the help desk for passwordresets.Compliance documentation – To satisfy regulators and auditors, organizations must not onlydemonstrate that a certain security process or control is in place, but also produce documentationthat the process is being used in specific cases. For instance, organizations need to documenthow promptly accounts are disabled after employee terminations and when group membership isrevoked in due to job changes.Forensic analysis and security incident response – When a system intrusion or other securityincident occurs, analysts may be hampered without an audit trail of all relevant AD changes.Analysts need to be able to search the audit trail left by the intruder or malicious insider using avariety of sorting and grouping techniques.Operational accountability – The dire consequences of erroneous changes to Active Directoryhas already been discussed in this document. When an operational mistake is made,management must be able to determine how the mistake was made, by whom and when. Withoutthis information, the enterprise can’t prevent the problem from happening again, nor can it assignresponsibility or take appropriate action against policy violations.Enterprise activity correlation – AD changes are only a portion of the overall IT activity thatorganizations must be able to monitor and analyze. Other typical sources of event data includelogon and authentication auditing, network connection, and access to applications and resources.Analysts frequently need to correlate events from these different kinds of log data to see thecomplete picture of what is happening on the network. Therefore, ultimately AD change trackingdata needs to be aggregated with the rest of an organization’s log data into a single repository fordetailed analysis.Directory integration/synchronization monitoring – To improve security, operationalefficiency, organizational responsiveness, and compliance, organizations are increasinglyintegrating or synchronizing directory information between systems to automate identity andaccess management. Debugging and managing the flow of identity information between ActiveDirectory can be complicated, and engineers need visibility into changes made bysynchronization processes.Technical Brief: Protecting and Auditing Active Directory with Quest Solutions7

Security Event Management and CorrelationActive Directory changes are only one channel of the wider stream of security activity. Informationsecurity analysts must correlate AD changes with related activity such as AD authentication events andWindows server security events. Ultimately AD audit events need to be aggregated with the rest of theorganization’s security monitoring.This is especially important in larger enterprises where AD administrators are separate from informationsecurity staff. AD change events must be merged into their overall view of enterprise-wide securityactivity.Secure Audit TrailMost organizations ultimately depend on audit logs as evidence for internal investigations and legalproceedings. For audit logs to be admissible as evidence, organizations must produce the original auditlogs and demonstrate that they were not altered. Because audit data tends to be both voluminous andredundant, organizations may reduce storage requirements by normalizing audit data into different tables.However, such restructuring of the data can create the perception that audit record has been modified,rendering it inadmissible. Furthermore, normalization can create indexing problems and performanceissues at insertion and query time. Unfortunately, the dynamic accessibility and block-oriented format ofdatabases means they do not function well as an unalterable repository for large amounts of redundantdata.Most reporting and analysis processes require that AD audit data reside in a relational database forefficient query capability. However, security and compliance requirements demand that audit logs beprotected from modification and stored for long periods of time. So while a relational database may berequired for temporary storage of audit data for reporting and analysis, audit logs must ultimately bepreserved in a high-integrity repository that supports digital signatures and compression.This repository must also be segregated from AD’s operational administrators, because a database withinthe forest is accessible to all forest administrators and can be modified or even erased. Therefore, todeter or detect unauthorized changes, the permanent copy of any audit data must reside in a repositoryoutside of the jurisdiction of its administrators.Technical Brief: Protecting and Auditing Active Directory with Quest Solutions8

Providing Comprehensive Audit andProtection for Active DirectoryIntroductionBy combining ChangeAuditor for Active Directory (CAAD) with Quest InTrust, Quest Software providescomprehensive audit and protection for Active Directory:ChangeAuditor provides core change tracking, monitoring and reporting.InTrust provides a long-term, secure audit trail and correlates audit data with other IT activity.Change TrackingReal-timeMonitoringSecurity EventManagement(SEM) andCorrelation Alerting Object protection Integration with systemsmanagement solutionsReportingChangeAuditor forActive Directory Planning and analysis Compliance documentation Forensic analysis andsecurity incident response Operational accountability re AuditTrail Long-term and highintegrity Admissible as evidence Accountability over ADadministratorsQuest InTrustFigure 2 - ChangeAuditor and InTrust provide comprehensive auditing and protection for AD.Technical Brief: Protecting and Auditing Active Directory with Quest Solutions9

ChangeAuditor for Active DirectoryChangeAuditor monitors Active Directory domain controllers in real time, preventing unauthorizedchanges to protected objects and recording allowed changes for specified objects, users and actions. Italso provides advanced alerting and reporting.ChangeAuditor’s architecture is comprised of three components. These work with the SQL Serverrelational database that contains ChangeAuditor’s audit data and torAgentAgentAgentChangeAuditorClientDomain ControllersSQL AuditorChangeAuditorCoordinatorCoordinatorSMTP Email AlertsSNMPSystems Center Operations ManagerFigure 3 - ChangeAuditor architectureChangeAuditor Agent – ChangeAuditor’s change tracking engine resides in the ChangeAuditoragent, which runs on each domain controller. As the agent monitors any attempts to changevarious objects in AD, it compares each requested change to the object protection policiespreviously defined by ChangeAuditor users. If the change matches a prohibited combination ofuser, action and object, ChangeAuditor prevents the change from being made. Otherwise,ChangeAuditor records the event to the ChangeAuditor database according to the organization’sCAAD configuration policy that defines which objects, users and actions are audited.ChangeAuditor Coordinator – The ChangeAuditor Coordinator monitors new activity beinglogged to the ChangeAuditor database and generates SMTP e-mail alerts and SNMP traps. It canalso send events to SCOM, depending on the activity and ChangeAuditor’s configured alertpolicy. Additional ChangeAuditor Coordinators and a SQL Server cluster can be implemented forfault-tolerance.ChangeAuditor Client – IT staff use the ChangeAuditor Client to access and configureChangeAuditor, as well as run reports and conduct analysis. Reports can also be scheduled andautomatically delivered via SQL Reporting Services, which integrates directly with theChangeAuditor Client. With this client, staff can quickly determine who changed what, when thechange occurred, and where the change originated.Intelligent AD AuditingUnlike native AD auditing, which is limited to simple object/property schema-based auditing, theChangeAuditor agent provides intelligent auditing of AD changes. It addresses the specialized auditingrequirements arcane to Active Directory as described in the Change Tracking section earlier in thisdocument.Nested group changes fully expandedChangeAuditor intelligently monitors nested group memberships and faithfully reports indirect groupmembership additions. To use the example given earlier, if John is made a member of the groupTechnical Brief: Protecting and Auditing Active Directory with Quest Solutions10

Directory Services Engineers, which in turn is a member of Enterprise Admins, ChangeAuditor alerts youthat a new member has gained all-powerful Enterprise Admins membership.Scenario: User added to nested groupDirectory ServicesEngineersEnterprise AdminsNative ADaudit event:(none)ChangeAuditoreventFigure 4. Nested group membership changes are reported by ChangeAuditorTechnical Brief: Protecting and Auditing Active Directory with Quest Solutions11

Changes to group policy settings reported in detailAs explained earlier, a GPO’s configuration settings reside in the file system of each domain controller, sothe native audit log can tell you only that a GPO was modified, but not which settings were changed ortheir values before and after the change. ChangeAuditor, on the other hand, reports exactly whichsettings within the GPO were changed and provides the before and after values for the settings, asshown below:Scenario: Group Policy Object ModifiedNative ADaudit eventChangeAuditoreventTechnical Brief: Protecting and Auditing Active Directory with Quest Solutions12

Permission changes fully reported, without redundant notificationsAt best, native AD auditing can report only that there was some kind of permission change on a givenOU; moreover, it floods the security log with hundreds or thousands of additional notifications for eachchild object within that OU and its sub-OUs. ChangeAuditor, however, reports a single permission changeevent for the object where the permissions were actually modified, and specifies exactly which entrieswere deleted and/or added:Scenario: Active Directory permissions delegated for a given organizational unitNative AD auditeventChangeAuditoreventTechnical Brief: Protecting and Auditing Active Directory with Quest Solutions13

Plain language used instead of cryptic AD schemaWhile the native AD audit log reports changes using cryptic schema names for objects and properties,ChangeAuditor reports AD changes in plain language easily understood by IT staff:Scenario: Last name of user account changedNative AD auditeventChangeAuditoreventQuest InTrustWhile ChangeAuditor provides real-time monitoring and reporting, Quest InTrust provides the securityaudit trail and security event management (SEM) for comprehensive auditing and protection of ActiveDirectory. InTrust is a modular log management and change auditing platform with optional integrationwith ChangeAuditor for specialized monitoring functionality, and knowledge packs for expert analysis oflog and monitoring data.The InTrust platform provides log collection, alerting, archival and reporting. InTrust has built-in supportfor the common log formats, including Windows event logs and any type of text file log, as well as syslogstreams for support of UNIX, Linux and network devices such as routers and firewalls.In addition, InTrust provides a secure log-based repository that can securely and efficiently store largeamounts of audit data. This protects the data from tampering and keeps it separate from the operationalAD administrators, providing deterrence and detection control.Technical Brief: Protecting and Auditing Active Directory with Quest Solutions14

Integration of InTrust and ChangeAuditorIn larger enterprises where AD administrators are separate from information security staff, AD changeevents must be merged into one overall view of enterprise-wide security activity. Quest delivers this viewby integrating the ChangeAuditor auditor event stream into InTrust’s enterprise-wide security eventmanagement capabilities.ChangeAuditor agents can be

Directory with Quest Solutions. Technical Brief: Protecting and Auditing Active Directory with Quest Solutions 1 . Quest, Quest Software, the Quest Software logo, AccessManager, ActiveRoles, Aelita, Akonix, AppAssure, Benchmark Factory, Big Brother, BridgeAccess, BridgeAutoEscalate, BridgeSearch, .