Learn Active Directory - Active Directory Compliance & Auditing

#Introduction

In episode 27 we built AD for enterprise scale. Organizations that large live under scrutiny: regulators, auditors, and clients demand proof. The question asked isn't "is your AD design good?", but "prove who has access to what, who changed what, and when?".

Compliance is the opposite of trust: it forces an organization to prove its controls, not just claim them. This episode dissects turning AD from merely a directory into a source of compliance evidence — from audit policy to reports you can show an auditor.

#Regulations and Their Demands on AD

Every regulation has different language and focus, but they all boil down to the same thing: who can access what, and what trace is left behind.

The first step of compliance isn't enabling every setting — it's mapping AD controls to the regulation requirements relevant to your organization. Certifications like SOC 2 or ISO 27001 often become the framework that ties it all together.

#Advanced Audit Policy

Auditing in Windows is divided into categories: Account Logon, Logon/Logoff, Account Management, Directory Service Access, Policy Change, Privilege Use, and Object Access. For a domain, a key point: domain account logon events are recorded on the DC, not the user's computer — so audit must be enabled on DCs.

Enable via GPO (Computer Configuration, Windows Settings, Security Settings, Advanced Audit Policy Configuration) or directly with auditpol for a quick test:

auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable
auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable
auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable

Install a SACL on the domain root for replication rights and monitor event 4662 to detect DCSync attempts before credential hashes leak.

#Auditing Privileged Access

Privileged access is the zone auditors watch most closely. Focus auditing on:

• Changes to privileged group membership (Domain Admins, Enterprise Admins, Schema Admins): events 4728, 4732, 4756.
• New accounts that immediately join privileged groups or are created outside standard OUs.
• Accounts with the adminCount attribute indicating they were once privileged group members — including those that maybe shouldn't be.

A simple report for finding privileged accounts:

Get-ADUser -Filter "adminCount -eq 1" -Properties adminCount, PasswordNeverExpires, PasswordLastSet |
    Select-Object SamAccountName, PasswordNeverExpires, PasswordLastSet

Integrate with the monitoring from episode 23: every privileged group change must trigger an alert, not just be recorded in a log.

#Change Management and Separation of Duties

Two concepts inseparable from compliance:

• Change management. Every change to the schema, GPOs, OU structure, trusts, or domain permissions must go through a flow: request, approval, implementation, verification, documentation. Schema changes only by Schema Admins, tested in the lab, and scheduled outside peak hours.
• Separation of duties. The person requesting a change must not be the only one approving and implementing it. Monitoring must be done by a separate party — most simply, the security team monitors changes made by the infra team.

Back up GPOs periodically (GPMC) and keep version archives. This gives two benefits: fast rollback and proof of "what changed, when, and by whom" for auditors.

#Reporting: Who Has Access to What

Auditors aren't interested in processes — they're interested in answers to specific questions. Prepare reports that answer them routinely:

• User access review — division managers confirm that group membership is still correct (periodic recertification).
• Privileged group report — who's in Domain Admins, Enterprise Admins, and other sensitive groups.
• Recursive group membership — for project groups containing subgroups, use -Recursive:

Get-ADGroupMember -Identity "Share-Proyek-A" -Recursive |
    Select-Object Name, SamAccountName | Sort-Object SamAccountName

• Dead and inactive accounts — the most common source of access leakage:

$cutoff = (Get-Date).AddDays(-90)
Get-ADUser -Filter * -Properties LastLogonDate |
    Where-Object { $_.LastLogonDate -lt $cutoff } |
    Select-Object SamAccountName, LastLogonDate

• Password policy compliance — accounts with PasswordNeverExpires, accounts without required password changes, and PSO status (episode 11).

Schedule these reports as monthly reporting and keep the results — report archives are proof that the review process actually runs.

#Certificate Lifecycle

If you run AD CS (episode 18), compliance covers the certificate lifecycle: enrollment, renewal, revocation, and CRL publication. Things that get audited:

• Root and subordinate CA validity — a missed root CA renewal can break the entire trust chain.
• Certificate issuance — audit events 4886 (pending) and 4887 (issued) on the CA.
• CRL and AIA publication — an expired CRL makes certificate validation fail.
• Template policies — who may enroll for which template; the "Domain Controller" template must be tightly restricted.

#Log Retention and Storage

Evidence without retention is meaningless. Set a retention policy:

• Security event log — set log size and retention policy so important events aren't overwritten before analysis. For audited environments, archive to a SIEM (episode 23) and keep per regulation requirements (PCI-DSS requires logs available for 1 year).
• System state backup — keep per data retention policy and test its restore (episode 26). For GDPR, also think about the right to delete personal data.
• Review report archives — keep recertification results for at least a few audit periods.

#Conclusion

In episode 28 you understood compliance as work of proving: mapping regulations (SOX, HIPAA, PCI-DSS, GDPR) to AD controls, enabling the right advanced audit policy with SACLs for DCSync, auditing privileged access, applying change management and separation of duties, producing access reports you can show an auditor, maintaining the certificate lifecycle, and setting retention for logs, backups, and archives.

Key points:

• Without a SACL, Directory Service auditing means nothing.
• Privileged group monitoring must trigger alerts, not just be recorded.
• Periodic archived reports are proof that controls work.
• Periodic recertification closes the access gaps most commonly exploited.

After proving controls, there's one step forward demanded by almost all regulations and modern security trends: strengthening authentication itself. In episode 29 we dissect Modern Authentication & Passwordless: Windows Hello for Business, FIDO2, passkeys, MFA, and Conditional Access in the Microsoft Entra ID era. See you there!