locked
Where can I find this log when advance auditing is already enabled? RRS feed

  • Question

  • Hi,

    Where can I find the event log for "Security-Disabled Universal Group" AKA Email Distribution Group?

    I would like to monitor changes in the Email Distribution Groups.(such as when I add or remove a user or rename the distribution group).   My Advance auditing is turned on and working.  I know because all other group changes (security-enabled groups) are being monitored and written without a problem. 

    What I could not find is the event log when I modify or change the Distribution Group in Exchange or Active Directory. Where can I find and what number is it? I looked for 4760 event logged but I can't find it when I make a change.  I am running Windows 2012.

    Thanks!



    • Edited by DoBongSoon Wednesday, May 2, 2018 5:06 PM
    Wednesday, May 2, 2018 3:50 PM

Answers

  • Found it! In Auditing Computer\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit Distribution Group Management - SUCCESS and FAILURE should be both checked.  I only had success.
    • Marked as answer by DoBongSoon Thursday, May 3, 2018 10:56 PM
    Thursday, May 3, 2018 10:56 PM

All replies

  • Hi,

    Please make sure that you have below audit group policy enabled:
    Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit Distribution Group Management

    Best Regards,
    Eve Wang

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, May 3, 2018 8:49 AM
  • Yes, mine is enabled with "Success".  It is only the Distribution Group that I couldn't find the log. Any other idea?

    Thursday, May 3, 2018 3:43 PM
  • Found it! In Auditing Computer\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit Distribution Group Management - SUCCESS and FAILURE should be both checked.  I only had success.
    • Marked as answer by DoBongSoon Thursday, May 3, 2018 10:56 PM
    Thursday, May 3, 2018 10:56 PM
  • Hi,

    Thank you for taking the time to share details. Your share might be helpful for other people who has similar problem. 

    If there is anything else we can do for you, please feel free to let us know.

    Best Regards,
    Eve Wang

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, May 4, 2018 2:00 AM