.svg){kind=icon}
Netwrix Auditor 
Netwrix Change Tracker 
Netwrix Data Classification 
Netwrix Enterprise Auditor 
Netwrix GroupID 
Netwrix Password Policy Enforcer 
Netwrix Password Secure 
Netwrix Password Reset 
Netwrix PolicyPak 
Netwrix Privilege Secure 
Netwrix Recovery for Active Directory 
Netwrix StealthINTERCEPT 
Netwrix Strongpoint 
Netwrix Threat Manager 
Netwrix Usercube 
Netwrix 1Secure 
Netwrix Endpoint Protector 
Native Auditing
Netwrix Auditor for Active Directory
Steps
- Run gpedit.msc → Create a new GPO → Edit it by going to "Computer Configuration" → Policies → Windows Settings → Security Settings :
- Advanced Audit Policy Configuration → Audit Policies → Object Access → Audit File System > Define → Success and Failures
- Advanced Audit Policy Configuration → Audit Policies → Object Access → Audit Handle Manipulation → Define → Success and Failures
- Local Policies → Audit Policy → Audit directory service access → Define → Success and Failures.Event Log → Define → Maximum security log size to 4gb and Retention method for security log to "Overwrite events as needed".
- Link the new GPO to OU by going to "Group Policy Management" → Right-click the defined OU → Choose "Link an Existing GPO" → Choose the GPO that you’ve created.
- Force the group policy update in "Group Policy Management" by right-clicking the defined OU → Click "Group Policy Update".
- Open ADSI Edit → Connect to Default naming context → Expand “DC=domain name”→ Expand “CN=System” → Right-click "CN=Policies" → Choose Properties → Security (Tab) → Advanced → Auditing (Tab) → Click "Add" → Choose the following settings:Principal: «Everyone»; Type: «Success»; Applies to: «This object and all descendant objects»; Permissions: «Delete groupPolicyContainer objects» → Click "OK".
- Navigate to the \\domainname\sysvol\domainfqdn → right-click "Policies" folder and select "Properties".
- Select the "Security" tab → "Advanced" button → "Auditing" tab → Click "Add" and set the following parameters: Principals: "Everyone";Type: “All”; Applies to: “This folder, subfolders and files”; Advanced Permissions: “Write attributes; Write extended attributes; Delete; Delete subfolders and files”; Click "OK" three times.
- To define what Group Policy was deleted, filter Security Event Log for Event ID 4663 (Task Category – "File System" or "Removable Storage") and search for "Object Name:" string, where you can find the path and GUID of deleted policy.
"Account name" field shows who deleted a Group Policy object.
Report sample:
- Run Netwrix Auditor → Click “Reports” → Navigate to Active Directory → Choose “Group Policy Changes” → Select "All Group Policy Changes" report → Click “View”.
- To save the file, click the "Export" button → Select Excel format → Save as → Choose a location to save it.
Report sample:
