Domain controller auditing baseline: the events every AD team should collect

Categories for domain controllers

On DCs, add these to the general baseline: Kerberos Authentication Service and Kerberos Service Ticket Operations (4768, 4769, 4771), Credential Validation (4776), Directory Service Changes (5136, 5137, 5141), Directory Service Access (4662), Computer Account Management (4741, 4742), and Security Group Management (4728, 4732, 4756).

Directory Service Changes only logs objects whose SACL asks for it. The default domain SACL covers many objects, but check that privileged groups, AdminSDHolder, GPO containers, and the domain root are included.

Reading Event 5136

5136 records a directory object modification with the object DN, the attribute, the operation (value added or deleted), and the value. A change is usually two events: delete the old value, add the new. That makes it ideal for detecting changes to member, servicePrincipalName, userAccountControl, msDS-AllowedToActOnBehalfOfOtherIdentity, and nTSecurityDescriptor.

Group by Correlation ID to pair the old and new values of one change.

Snippet

auditpol /set /subcategory:"Directory Service Changes" /success:enable
auditpol /set /subcategory:"Directory Service Access" /success:enable
auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5136; StartTime=(Get-Date).AddHours(-1)} |
  % { $x=[xml]$_.ToXml(); $d=@{}; $x.Event.EventData.Data | % { $d[$_.Name]=$_.'#text' }
      [pscustomobject]@{Time=$_.TimeCreated; By=$d.SubjectUserName; Object=$d.ObjectDN; Attr=$d.AttributeLDAPDisplayName; Op=$d.OperationType; Value=$d.AttributeValue} }

Lab: high-value change detections

Make five changes in the lab: add an SPN to a user, set pre-auth not required, add a member to Domain Admins, change the ACL on AdminSDHolder, and set RBCD on a computer. Confirm each produces 5136 with the attribute name. Write one detection per attribute and record which event and field each uses.

That list of five detections covers a large share of real persistence and escalation techniques in AD.

Ship and size

DC Security logs are busy. Forward them centrally and size them at several gigabytes. Monitor that every DC is reporting.

Microsoft Defender for Identity or similar sensors add behavioral detections on top, but they rely on the same underlying events and network traffic.

Diagram

Attributes worth a 5136 alert

Changes that often signal escalation or persistence.

member on privileged groups
New privileged membership.
servicePrincipalName on users
A user made kerberoastable.
userAccountControl
Pre-auth disabled, delegation enabled, password not required.
msDS-AllowedToActOnBehalfOfOtherIdentity
New RBCD configuration.
nTSecurityDescriptor on AdminSDHolder
ACL change that propagates to all admins.

Check yourself

1. Which subcategory produces 5136?

2. How do you pair the old and new value of a single change?

3. A 5136 adds servicePrincipalName to a user account. Why care?