Would you like to learn how to configure a group policy to audit the LDAP queries to Active Directory? In this tutorial, we will show you how to configure the monitoring of LDAP queries on the domain controllers using a GPO.
• Windows 2012 R2
• Windows 2016
• Windows 2019
• Windows 2022
• Windows 10
• Windows 11
Equipment list
Here you can find the list of equipment used to create this tutorial.
This link will also show the software list used to create this tutorial.
Windows Related Tutorial:
On this page, we offer quick access to a list of tutorials related to Windows.
Tutorial GPO - Monitor LDAP queries on Active Directory
On the domain controller, open the group policy management tool.
Create a new group policy.
Enter a name for the new group policy.
In our example, the new GPO was named: MY-GPO.
On the Group Policy Management screen, expand the folder named Group Policy Objects.
Right-click your new Group Policy Object and select the Edit option.
On the group policy editor screen, expand the Computer configuration folder and locate the following item.
Right-click on the Registry option and create a Registry entry.
On the registry screen, perform the following configuration.
Click on the OK button.
Create the second required registry entry.
Click on the OK button.
Create the third registry entry.
Click on the OK button.
Create the forth registry entry.
Click on the OK button.
Here is the configuration summary.
To save the group policy configuration, you need to close the Group Policy editor.
Congratulations! You have finished the GPO creation.
Tutorial GPO - Monitor LDAP queries on Active Directory
On the Group policy management screen, link the GPO to the Domain controllers Organizational Unit.
In our example, we linked the group policy named MY-GPO to the domain controllers.
After applying the GPO you need to wait for 10 or 20 minutes.
During this time the GPO will be replicated to other domain controllers.
On a domain controller, start an elevated Powershell command line.
List events related to LDAP queries.
Here is the command output.
Get details from LDAP events.
Here is the command output.
Search for specific LDAP events.
In our example, we enabled the audit of LDAP events using a GPO.
