Active Directory, Second Edition

Using the GUI to Examine Auditing

Examining auditing entries is almost identical to viewing permissions entries. If you go back to the screen shown in Figure 11-3 and click on the Auditing tab, a screen similar to that in Figure 11-11 is displayed.

Figure 11-11. Advanced Settings window showing auditing entries

This window shows the list of Auditing Entries (AEs) that have been defined on the object. This object has one AE, and it’s not very helpful viewing it from here since the detail is too limited. So just as you would do with permissions, you can click the Edit button (or View/Edit with Windows 2000), drill down, view the individual AE itself.

Figure 11-12 shows the successful and failed items that are being awaited. The items are grayed out because this entry is inherited from further up the tree, i.e., it is not defined directly on this object but instead further up the hierarchy.

Figure 11-12. Auditing entry for an object

Figure 11-13 shows an example AE window for successful and failed auditing of properties. Here you are auditing only property writes.

Figure 11-13. Auditing entry for an object’s properties