-
タイトル
Auditing LAPS Password access -
説明
The LAPS Solution for Active Directory contains the option to configure an Auditing Event ID:
Set-AdmPwdAuditing –OrgUnit: -AuditedPrincipals: :
When a User accesses the LAPS password attribute, event ID 4662 is logged on the Domain Controller that responded to the read request.When using Active Roles to manage LAPS, this is somewhat obscured: the native event ID will only note the Active Roles service account and not the Active Roles initiator.The Active Roles Event Viewer logs do not show any special event when the LAPS password attribute is accessed. -
原因
By design, there are no event ID's which are posted in the Active Roles Event logs when any attribute is read, only when an attribute is modified.
Enhancement ID 168879 has been created to track a requested change to existing product functionality.
-
対策
WORKAROUND
Custom Active Roles Event Viewer logging could be introduced into an existing Active Roles configuration via a custom scripted solution.Such a solution would need to leverage the onPreGet Event Handler as well as the EventLog Object.The IsAttributeRequested method on the $Request object would be the best way to confirm that the LAPS Password attribute is being viewed, and the OperationInitiatorSid method on the $Request object will provide the SID of the user who initiated the operation.If there are questions or concerns about creating a custom scripted solution, please contact an account manager or contact One Identity Sales for a quote on a Professional Services engagement.STATUS
An enhancement request has been created to integrate this functionality into Active Roles.
Product Management will evaluate the request and this feature may become available in a future release of the product.
There are no guarantees that this specific enhancement request will be implemented in a future release.
For more information regarding our Enhancement Request policy, refer to our Global Support Guide on the Support Portal at: https://support.oneidentity.com/essentials/support-guide/
-
変更要求
TF00168879