Hello,
We are looking for a good Active Directory Audit Tool to help me and my colleagues perform periodic Active Directory audits. We have been recently given responsibility for performing independent audits of our Active Directory, so would like to get some input on a good tool to perform these AD audits.
We are NOT looking for an AD Auditing tool. We already have auditing in place, and are happy with it. We do have a budget for this, and we're looking for something that is supported because we are not AD experts or admins, so we need something that's easy to use and is supported.
In case it helps, we need to be able to audit and document all accounts, groups and their memberships, all default admin accounts, accounts with elevated access, delegated rights and admins, access rights on critical objects (e.g. Domain Admin group, Administrators account etc), directory service audit settings (i.e. SACL on AD objects) etc. The objective is to perform periodic security audits independently of our AD team, so we can inform them if we find anything strange.
We have tried some MS tools like dsacls, acldiag, dsquery etc, but its a pain to work with so many tools in command-line, and to export data and produce reports for management.
Merci!
Alain.