As part of some Domain Controller tests that I'm running, I would like to find out if a "net user /domain" command was used from one of my endpoints.

So, is there any log (on the DC) that can tell me whether such a command was used?


1 Answer 1


From the domain controller's perspective, there's no difference between someone looking at AD objects using Active Directory Users and Computers, net user /domain, or any other tool that looks through the directory. If you really want to audit process creation and termination, see Task Manager shows programs that are running - how can I see the ones that have been ended?

That said, you can audit AD object access. First, adjust your domain controllers' audit policy (Computer ConfigurationPoliciesWindows SettingsSecurity SettingsLocal PoliciesAudit Policy) to audit successful directory service access. Then go to ADUC and enable advanced features (under View). On each OU that contains users, open to Properties window to the Security tab. Click the Advanced button, then switch to the Auditing tab. There, add a List contents (or Full control if you want) entry that applies to Everyone. On the Auditing tab, entries don't grant access; they just mark objects for auditing. Then, any user that runs a program that enumerates those OUs will end up adding an event 4662 (Directory Service Access) to the DC's event log with all relevant information.

Alternatively, you could create a single "honeypot" user account to which all access (Full control) is audited. Since net user /domain looks at a few properties of the users it finds, it will trigger the auditing.

an audit entry

Further reading: AD DS Auditing Step-By-Step Guide

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.