Audit Active Directory Objects in Windows Server 2003 (設定稽核Windows 2003 Active Directory物件)

若存取AD物件發生此錯誤"Access Denied" error code 0x80007005
可設定稽核來找到未授權存取的LDAP屬性


To configure an audit policy setting for a domain controller:

1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
2. On the View menu, click Advanced Features.
3. Right-click Domain Controllers, and then click Properties.
4. Click the Group Policy tab, click Default Domain Controller Policy, and then click Edit.
5. Click Computer Configuration, double-click Windows Settings, double-click Security Settings, double-click Local Policies, and then double-click Audit Policy.
6. In the right pane, right-click Audit Directory Services Access, and then click Properties.
7. Click Define These Policy Settings, and then click to select one or both of the following check boxes:
   • Success: Click to select this check box to audit successful attempts for the event category.
   • Failure: Click to select this check box to audit failed attempts for the event category.
8. Right-click any other event category that you want to audit, and then click Properties.
9. Click OK.
10. Because the changes that you make to your computer's audit policy setting take effect only when the policy setting is propagated or applied to your computer, complete either of the following steps to initiate policy propagation:
    • Type gpupdate /Target:computer at the command prompt, and then press ENTER.
    • Wait for automatic policy propagation that occurs at regular intervals that you can configure. By default, policy propagation occurs every five minutes.
11. Open the Security log to view logged events.
    
    Note If you are either a domain or an enterprise administrator, you can enable security auditing for workstations, member servers, and domain controllers remotely.

Configure Auditing for Specific Active Directory Objects

After you configure an audit policy setting, you can configure auditing for specific objects, such as users, computers, organizational units, or groups, by specifying both the types of access and the users whose access that you want to audit. To configure auditing for specific Active Directory objects:

1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
2. Make sure that Advanced Features is selected on the View menu by making sure that the command has a check mark next to it.
3. Right-click the Active Directory object that you want to audit, and then click Properties.
4. Click the Security tab, and then click Advanced.
5. Click the Auditing tab, and then click Add.
6. Complete one of the following:
   • 
     
   • Type the name of either the user or the group whose access you want to audit in the Enter the object name to select box, and then click OK.
   • In the list of names, double-click either the user or the group whose access you want to audit.
7. Click to select either the Successful check box or the Failed check box for the actions that you want to audit, and then click OK.
8. Click OK, and then click OK.

[Reference]
How to troubleshoot access denied in a split permission model or minimum permissions mode

HOW TO: Audit Active Directory Objects in Windows Server 2003