> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/04-active-directory-security-monitoring/configure-ad-audit-policy.md).

# Configure Active Directory Audit Policy

Before testing Active Directory changes, configure auditing so Windows records the activity in the Security log.

## Objective

Create a small Group Policy Object for domain controller auditing and enable the account management events used in this section.

## Why Use a Separate GPO

Instead of editing the default domain controller policy, create a dedicated lab GPO. This keeps the configuration easier to understand, review, and remove later.

Use this name:

```
ZyberLab - Domain Controller Auditing
```

## Create the GPO

On `DC01`:

1. Open **Server Manager**.
2. Open **Tools**.
3. Select **Group Policy Management**.
4. Expand the forest and domain.
5. Locate the **Domain Controllers** organizational unit.
6. Right-click **Domain Controllers**.
7. Select **Create a GPO in this domain, and Link it here**.
8. Name the GPO:

```
ZyberLab - Domain Controller Auditing
```

## Configure Account Management Auditing

Edit the new GPO and browse to:

```
Computer Configuration
Policies
Windows Settings
Security Settings
Advanced Audit Policy Configuration
Audit Policies
Account Management
```

Enable **Success** for these subcategories:

* Audit User Account Management
* Audit Security Group Management

For this beginner lab, Success auditing is enough for the account changes we want to observe.

## Apply the Policy

You can wait for normal Group Policy refresh or restart `DC01` if you want the simplest beginner approach.

After the policy applies, open:

**Event Viewer > Windows Logs > Security**

The Security log should continue receiving events normally.

## What This Policy Records

The enabled audit categories can record activity such as:

* creating a user
* enabling or disabling an account
* resetting a password
* changing user account properties
* deleting a user
* adding a member to a security group
* removing a member from a security group

## Verification

The best verification is practical. Complete the next lab and create a temporary domain user. If Event ID `4720` appears on `DC01`, the auditing required for user account management is working.

## Security Relevance

Audit policy determines which security activities Windows records. A monitoring rule cannot detect an event that the operating system never logs, so logging configuration is part of the security control itself.