[Samba] Monitor changes that occur in an OU

[Elias Pereira]

As I described above, I can identify the creation of the new user,
but is there anything in the log that shows a new user is created
or another type of addition occurring in AD?

On Mon, Aug 16, 2021 at 9:36 PM Elias Pereira <empbilly at gmail.com> wrote:

> Ok. I was able to check the logs when I add a new user.
>
> Is there something in the log that shows that it is referring to a new
> user?
>
> On Mon, Aug 16, 2021 at 9:17 PM Elias Pereira <empbilly at gmail.com> wrote:
>
>> Nice!!! Thanks for the help, Andrew!!!
>>
>> On Mon, Aug 16, 2021 at 8:46 PM Andrew Bartlett <abartlet at samba.org>
>> wrote:
>>
>>> No, you would get all changes across the whole server, and need to
>>> filter those back out in an external tool.
>>>
>>> However the good news is that the information is there.
>>>
>>> Andrew Bartlett
>>>
>>> On Mon, 2021-08-16 at 20:42 -0300, Elias Pereira wrote:
>>> > hello Andrew, thanks for the answer!!!
>>> >
>>> > Is there a specific flag in this log that I
>>> > can monitor when creating a new user?
>>> >
>>> > On Mon, Aug 16, 2021 at 8:11 PM Andrew Bartlett <abartlet at samba.org>
>>> > wrote:
>>> > > On Mon, 2021-08-16 at 11:47 -0300, Elias Pereira via samba wrote:
>>> > > > Hi,
>>> > > >
>>> > > > Would there be any way to monitor changes
>>> > > > occurring in an OU?
>>> > > >
>>> > > > Example, the creation of a new user.
>>> > > >
>>> > >
>>> > >
>>> https://wiki.samba.org/index.php/Setting_up_Audit_Logging#Enabling_AD_DC_Database_Audit_Logging
>>> > >
>>> > > dsdb_json_audit:5 is the log class you want.
>>> > > dsdb_transaction_json_audit:5 should be watched for the incredibly
>>> > > rare
>>> > > case where a transaction is aborted, as the audit log will have
>>> > > already
>>> > > been printed.
>>> > >
>>> > > I hope this helps,
>>> > >
>>> > > Andrew Bartlett
>>> > >
>>> > > --
>>> > > Andrew Bartlett (he/him)       https://samba.org/~abartlet/
>>> > > Samba Team Member (since 2001) https://samba.org
>>> > > Samba Team Lead, Catalyst IT
>>> > > https://catalyst.net.nz/services/samba
>>> > >
>>> > > Samba Development and Support, Catalyst IT - Expert Open Source
>>> > > Solutions
>>> > >
>>> >
>>> >
>>> --
>>> Andrew Bartlett (he/him)       https://samba.org/~abartlet/
>>> Samba Team Member (since 2001) https://samba.org
>>> Samba Team Lead, Catalyst IT   https://catalyst.net.nz/services/samba
>>>
>>> Samba Development and Support, Catalyst IT - Expert Open Source
>>> Solutions
>>>
>>>
>>
>> --
>> Elias Pereira
>>
>
>
> --
> Elias Pereira
>


-- 
Elias Pereira