Monitor Domain Admins using VMware Log Insight
I had a customer asking me yesterday, if it was possible to use Log Insight, to monitor changes done to the Domain Admins group.
An interesting use case, that i had not thought of before.
The answer is off course yes, so i thought i would write a small post about it.
The first thing I did, was to create a new user, with an easy search name.
So i created the user : liuser (as a name - not only logon name).
Then I added the user to the groups Domain Admins, and went to interactive analytics in Log Insight and did a search for liuser.
I then went to events, and clicked on show all lines, on the top event.
To make sure i only got the right details, i then marked the lines that i thought would narrow my search, and selected “contains=……“
I ended up with 2 filters in my search.
If it turns out, that it’s not enough, then i can always go back and modify my search.
Now all there is left, is to decide, if i want to show this as a widget, or get an alert everything this event happens.
Hope this gave some inspiration on what you can use Log Insight for. It suddenly did for me.