> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/04-active-directory-security-monitoring/investigate-ad-changes.md).

# Investigate Active Directory Changes

This page brings the previous labs together into a simple investigation method.

The goal is not only to find an event ID. The goal is to understand what happened and decide whether the activity makes sense.

## Start With the Event

When you find an Active Directory change in the Security log, begin with these questions:

1. What action occurred?
2. Which account, group, or object was affected?
3. Who performed the action?
4. When did it happen?
5. Was the activity expected?

## Identify the Actor

In many Windows security events, the **Subject** section identifies the account that performed the action.

Review fields such as:

* Security ID
* Account Name
* Account Domain
* Logon ID

The exact layout depends on the event type.

## Identify the Target

The target section normally identifies the account or group that was changed.

For example:

* Event ID `4720` identifies the newly created user
* Event ID `4728` identifies the group and added member
* Event ID `4726` identifies the deleted user

## Build a Simple Timeline

Record a small timeline when investigating several related events.

| Time        | Event ID | Action             | Actor          | Target     |
| ----------- | -------- | ------------------ | -------------- | ---------- |
| Record time | 4720     | User created       | Record account | tempuser01 |
| Record time | 4728     | Added to group     | Record account | tempuser01 |
| Record time | 4729     | Removed from group | Record account | tempuser01 |
| Record time | 4726     | User deleted       | Record account | tempuser01 |

The actual values should come from your lab events.

## Compare With Expected Activity

An event is not automatically malicious simply because it changes Active Directory.

Ask whether there is a reasonable explanation:

* Was this part of your lab exercise?
* Was the administrator expected to make the change?
* Is the target account appropriate?
* Did the privilege level increase?
* Was the change reversed or cleaned up afterward?

## Pay Extra Attention to Privilege

Prioritize changes involving groups such as:

* Domain Admins
* Enterprise Admins
* Administrators
* Account Operators
* Server Operators
* Backup Operators

The exact list of critical groups depends on the environment, but privileged access should always receive stronger monitoring.

## Keep the Investigation Simple

For beginner labs, a useful investigation note can contain:

```
Event:
Time:
Actor:
Target:
Change:
Expected or unexpected:
Evidence reviewed:
Conclusion:
```

This format builds good investigation habits without requiring a SIEM or complex case-management platform.

## Security Relevance

Security monitoring becomes valuable when raw events are converted into context. The same Event ID can represent normal administration or suspicious activity. Investigation connects the technical event with the reason behind the change.