How to Audit Active Directory Group Membership Changes

In Active Directory, groups are classified as Security or Distribution and can have one of three scopes: Global, Domain Local, or Universal. Tracking membership changes for a specific group across all these types and scopes become complex.

To make this easier, Active Directory provides dedicated group membership change event IDs for each type and scope. For instance, to monitor membership changes in the Administrator group, you can concentrate on the domain-local security group events instead of being overwhelmed by all group membership changes.

Windows Security log event IDs for auditing Active Directory group membership changes

When account management is enabled in the basic audit policy, Active Directory logs all events related to users, computers, and groups. This consumes valuable Security log space and generates a lot of log noise, making it difficult to focus on group membership changes.

Advanced Audit Policy Configuration addresses this by allowing you to log only group changes. This lets you capture the events you care about while reducing irrelevant data, minimizing log noise, and saving Security log space.

Enable advanced auditing policy in Active Directory

Configure object level auditing on Active Directory groups

With Advanced Audit Policy, you can capture group membership changes efficiently. You can take this further by using a SACL (System Access Control List) in Active Directory. It adds precision by tracking specific actions by a particular user on an object. This allows you to monitor group membership changes in a group without logging unrelated group updates, giving you precise and focused auditing. Follow the steps below to configure a SACL for auditing group membership changes by a specific user or group.

Note: If the Security tab doesn’t appear in the Properties tab, go to the View menu, and enable Advanced Features.

IT support often needs Domain Admin rights for urgent fixes, but manually remembering to revoke access afterward is risky. This is where time-based group membership becomes crucial. It allows admins to grant temporary access to groups that automatically expire after the specified time. This ensures the users retain privileges only as long as required.

Prerequisites for time-based group membership in Active Directory

Forest Functional Level: Must be set to Windows Server 2016 or higher.

Privileged Access Management (PAM): Needs to be enabled at the Active Directory forest root domain.

Administrative privileges: Only members of Enterprise Admin or Administrators group can enable PAM.

Enable time-based membership in Active Directory groups

Time-based group memberships are automatically revoked when the specified duration ends. In the meantime, you can manually remove members from the Active Directory groups at any time before expiration.

Note: When setting the Time To Live (TTL), you can specify the membership duration in minutes, hours, or days, depending on your requirements.

Accurate tracking of group membership changes is critical to maintain security and compliance, but native Active Directory auditing falls short in several key areas. These gaps turn routine auditing into a complex, time-consuming, and error-prone task, especially in large or multi-domain environments.

Understanding the following limitations helps admins design stronger monitoring strategies and close potential security gaps.

While native auditing provides some insight, its limitations often prevent full clarity when tracking group membership changes. AdminDroid addresses these gaps by offering ready-to-use reports, real-time alerts, and long-term data retention, all through a simple and intuitive interface.

• The group membership report gives clear insights into access management while avoiding challenges like high log volumes, Event ID complexity, limited filtering options, etc.
• With AdminDroid, you can receive instant alerts or Teams notifications whenever membership changes match your criteria.

Privileged AD groups like Domain Admins, Enterprise Admins, etc, are the power players in your Active Directory domain. A single unauthorized addition can create significant security gaps and open the door to misuse. That’s why it’s essential to keep a constant watch on privileged group membership changes to maintain a secure and compliant environment.

Run the below script to generate a report of users added/removed from the list of privileged groups in Active Directory. Replace <PrivilegedGroups> with a comma-separated list of the privileged group names you want to track.

$EventIDs = 4728,4729,4732,4733,4756,4757
$Events = Get-WinEvent -FilterHashtable @{
    LogName = 'Security'
    Id      = $EventIDs
} -ErrorAction SilentlyContinue
$Parsed = $Events | ForEach-Object {
    $Details = ([xml]$_.ToXml()).Event
     $Action = switch ($Details.System.EventID) {
        4728 {"Added"}
        4732 {"Added"}
        4729 {"Removed"}
        4733 {"Removed"}
        4756 {"Added"}
        4757 {"Removed"}
    }
    [PSCustomObject]@{
     TimeStamp   = (Get-Date $Details.System.TimeCreated.SystemTime -Format "yyyy-MM-dd HH:mm:ss")
     ChangedUser = $Details.EventData.Data[0]."#text"
     GroupName   = $Details.EventData.Data[2]."#text"
     ChangedBy   = $Details.EventData.Data[6]."#text"
     Action      = $Action
    }
}
$PrivGroups = @('<PrivilegedGroups>’)
$PrivChanges = $Parsed | Where-Object { $_.GroupName -in $PrivGroups }
$PrivChanges | Format-Table -AutoSize

• Use privileged group membership changes report to instantly gain insights into each group such as, Domain Admins, Enterprise Admins, and more. Track modifications including, added/removed time, group name, modified members, performed by, group scope, etc.
  
• Schedule this report weekly to automate auditing of all membership changes in high-risk groups and ensure to stay compliant without manual effort.

Active Directory group membership changes take effect only when the object’s access token is refreshed. This means the user must log off and log on, or the computer must restart, which can disrupt ongoing sessions or tasks. To avoid interruptions, you can manually refresh Kerberos tickets without disconnecting the session. This approach ensures users and computers receive updated access promptly without requiring a reboot.

Refresh Active Directory user group membership without logging off

Run these steps on the machine where the user is logged in to update membership immediately without restarting.

Refresh AD computer group membership without restarting

Handy Tips: