Netwrix Auditor 
Netwrix Enterprise Auditor 
Netwrix Data Classification 
Netwrix GroupID 
Netwrix Privilege Secure 
Netwrix Endpoint Protector 
Native Auditing
Netwrix Auditor for Active Directory
Steps
- Run gpedit.msc → Create a new GPO → Edit it by going to "Computer Configuration" → Policies → Windows Settings → Security Settings :
- Advanced Audit Policy Configuration → Audit Policies → Object Access → Audit File System > Define → Success and Failures
- Advanced Audit Policy Configuration → Audit Policies → Object Access → Audit Handle Manipulation → Define → Success and Failures
- Local Policies → Audit Policy → Audit directory service access → Define → Success and Failures.Event Log → Define → Maximum security log size to 4gb and Retention method for security log to "Overwrite events as needed".
- Link the new GPO to OU by going to "Group Policy Management" → Right-click the defined OU → Choose "Link an Existing GPO" → Choose the GPO that you’ve created.
- Force the group policy update in "Group Policy Management" by right-clicking the defined OU → Click "Group Policy Update".
- Open ADSI Edit → Connect to Default naming context → Expand “DC=domain name”→ Expand “CN=System” → Right-click "CN=Policies" → Choose Properties → Security (Tab) → Advanced → Auditing (Tab) → Click "Add" → Choose the following settings:Principal: «Everyone»; Type: «Success»; Applies to: «This object and all descendant objects»; Permissions: «Delete groupPolicyContainer objects» → Click "OK".
- Navigate to the \\domainname\sysvol\domainfqdn → right-click "Policies" folder and select "Properties".
- Select the "Security" tab → "Advanced" button → "Auditing" tab → Click "Add" and set the following parameters: Principals: "Everyone";Type: “All”; Applies to: “This folder, subfolders and files”; Advanced Permissions: “Write attributes; Write extended attributes; Delete; Delete subfolders and files”; Click "OK" three times.
- To define what Group Policy was deleted, filter Security Event Log for Event ID 4663 (Task Category – "File System" or "Removable Storage") and search for "Object Name:" string, where you can find the path and GUID of deleted policy.
"Account name" field shows who deleted a Group Policy object.
Report sample:
- Run Netwrix Auditor → Click “Reports” → Navigate to Active Directory → Choose “Group Policy Changes” → Select "All Group Policy Changes" report → Click “View”.
- To save the file, click the "Export" button → Select Excel format → Save as → Choose a location to save it.
Report sample:
