> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/04-active-directory-security-monitoring/active-directory-security-monitoring.md).

# Active Directory Security Monitoring Overview

This section turns the ZyberLab Active Directory environment into a simple security monitoring lab.

The goal is to make a change in Active Directory, find the related Windows security event, and understand what the event tells us.

## What You Will Learn

You will learn how to monitor common identity and access changes such as:

* user account creation
* account enable and disable actions
* password resets
* user account changes
* security group membership changes
* Domain Admins membership changes
* user account deletion

You will also learn how to identify who made a change, which account or group was affected, and when the activity happened.

## Systems Used

```
DC01
CLIENT01
```

Most Active Directory account management events in this section will be reviewed on `DC01` because it is the domain controller.

## Lab Approach

Each exercise follows the same pattern:

1. prepare the required audit policy
2. make one controlled change
3. open Event Viewer on `DC01`
4. find the relevant event
5. review the important fields
6. return the lab to its expected state when needed
7. record what you learned

## Important Rule

Use dedicated lab accounts for testing. Do not use production accounts, personal credentials, or systems outside your own authorized lab.

For privileged group exercises, remove the test account from the privileged group immediately after the event has been generated and verified.

## Core Event IDs

| Activity                                    | Common Event ID |
| ------------------------------------------- | --------------- |
| User account created                        | 4720            |
| User account enabled                        | 4722            |
| User account disabled                       | 4725            |
| Password reset attempted                    | 4724            |
| User account changed                        | 4738            |
| User account deleted                        | 4726            |
| Member added to a global security group     | 4728            |
| Member removed from a global security group | 4729            |

Other group types use different event IDs. The group monitoring page explains the common variations.

## Why This Matters

Active Directory controls access to systems, applications, data, and administrative privileges. Changes to users and groups can therefore have an immediate security impact.

A useful monitoring process should answer three simple questions:

* What changed?
* Who made the change?
* Was the change expected?

That same thinking will be used throughout the later detection and investigation labs.