Help Required on track active directory changes

Question

I am going to write a small software to track active directory changes. I need an expert opinion from you. I want to display information about What ( with before and after values), When, Where and Who of any change in AD. I am going to implement this by one of the following way 1. Change Notification Control 2. DirSync Control

Both of these method give us the attribute that are changed and we can compare new values with some dump in SQL Server to get old values.

My problem is how can I find “Who” has made this change. I have tried but there is no attribute “LastModifiedBy” in active directory. Please give your opinion how can I track who has made this change.

--Faisal Iqbal

Answer 1

My company uses ActiveRoles from Quest. No one actually makes changes directly to AD; all changes are done through ActiveRoles so we have that type of auditing (and a lot more benefits.)

Answer 2

Is there any reason you can't use AD Auditing?