Traceability of AD user actions

In a large enterprise, which begins with a national name, as an IT operation and maintenance administrator, there are a lot of things to pay attention to. Today, I will discuss security in uppercase. For example, in an enterprise, your account is deleted or cancelled or certain permissions are added without reason, but you do not. When the security department informs you that you are like this, the IT administrator is in trouble. She wants to help you trace what your account has done on a specified date, so let's see how to trace it.

Environmental background:

N DC across the country, father-son domain architecture

Customer requirements:

Query what actions the test domain account has done in the past 2 months and on which DC it has changed

AD user Action traceability prerequisites:

The DC domain controller opens the security audit log, traces the user results according to the command line, and queries the audit log to get the final result.

How to do it:

# Command format: * *

Repadmin / showobjmeta DC Server "Domain user CN path"

Note: DC Server can be any DC domain controller in Mori, but the result listed by this command is a list of records that the user has changed on any DC.

Example of the command:

Repadmin / showobjmeta dc01 "CN=test,OU= Smart Card, OU= Information Technology, DC=contoson,DC=com > d:\ test.txt