[Samba] Monitor changes that occur in an OU

Andrew Bartlett
Tue, 24 Aug 2021 19:21:34 -0000

You should be able to tell it is a user from the objectclass.

Andrew Bartlett

On Tue, 2021-08-24 at 10:41 -0300, Elias Pereira via samba
wrote:
> As I described above, I can identify the creation of the new user,
> but is there anything in the log that shows a new user is created
> or another type of addition occurring in AD?
>
> On Mon, Aug 16, 2021 at 9:36 PM Elias Pereira <empbilly at gmail.com>
> wrote:
>
> > Ok. I was able to check the logs when I add a new user.
> >
> > Is there something in the log that shows that it is referring to a
> > new
> > user?
> >
> > On Mon, Aug 16, 2021 at 9:17 PM Elias Pereira <empbilly at
gmail.com>
> > wrote:
> >
> > > Nice!!! Thanks for the help, Andrew!!!
> > >
> > > On Mon, Aug 16, 2021 at 8:46 PM Andrew Bartlett <
> > > abartlet at samba.org>
> > > wrote:
> > >
> > > > No, you would get all changes across the whole server, and
need
> > > > to
> > > > filter those back out in an external tool.
> > > >
> > > > However the good news is that the information is there.
> > > >
> > > > Andrew Bartlett
> > > >
> > > > On Mon, 2021-08-16 at 20:42 -0300, Elias Pereira wrote:
> > > > > hello Andrew, thanks for the answer!!!
> > > > >
> > > > > Is there a specific flag in this log that I
> > > > > can monitor when creating a new user?
> > > > >
> > > > > On Mon, Aug 16, 2021 at 8:11 PM Andrew Bartlett <
> > > > > abartlet at samba.org>
> > > > > wrote:
> > > > > > On Mon, 2021-08-16 at 11:47 -0300, Elias Pereira
via samba
> > > > > > wrote:
> > > > > > > Hi,
> > > > > > >
> > > > > > > Would there be any way to monitor changes
> > > > > > > occurring in an OU?
> > > > > > >
> > > > > > > Example, the creation of a new user.
> > > > > > >
> > > >
https://wiki.samba.org/index.php/Setting_up_Audit_Logging#Enabling_AD_DC_Database_Audit_Logging
> > > > > > dsdb_json_audit:5 is the log class you want.
> > > > > > dsdb_transaction_json_audit:5 should be watched
for the
> > > > > > incredibly
> > > > > > rare
> > > > > > case where a transaction is aborted, as the audit
log will
> > > > > > have
> > > > > > already
> > > > > > been printed.
> > > > > >
> > > > > > I hope this helps,
> > > > > >
> > > > > > Andrew Bartlett
> > > > > >
> > > > > > --
> > > > > > Andrew Bartlett (he/him)
https://samba.org/~abartlet/
> > > > > > Samba Team Member (since 2001) https://samba.org
> > > > > > Samba Team Lead, Catalyst IT
> > > > > > https://catalyst.net.nz/services/samba
> > > > > >
> > > > > > Samba Development and Support, Catalyst IT -
Expert Open
> > > > > > Source
> > > > > > Solutions
> > > > > >
> > > > --
> > > > Andrew Bartlett (he/him)       https://samba.org/~abartlet/
> > > > Samba Team Member (since 2001) https://samba.org
> > > > Samba Team Lead, Catalyst IT
> > > > https://catalyst.net.nz/services/samba
> > > >
> > > > Samba Development and Support, Catalyst IT - Expert Open
Source
> > > > Solutions
> > > >
> > > >
> > >
> > > --
> > > Elias Pereira
> > >
> >
> > --
> > Elias Pereira
> >
>
> --
> Elias Pereira
--
Andrew Bartlett (he/him)       https://samba.org/~abartlet/
Samba Team Member (since 2001) https://samba.org
Samba Team Lead, Catalyst IT   https://catalyst.net.nz/services/samba

Samba Development and Support, Catalyst IT - Expert Open Source
Solutions