How to monitor group policy changes in real time?

Hi all,

I'm interested in developing a real-time monitor that saves all
changes to group policy objects. Hopefully, this module will be
notified if any admins add/delete/modify GPOs.

Can anyone show me some pointers?

Thanks!
-Simon

Simon,

Simon wrote:
> I'm interested in developing a real-time monitor that saves all
> changes to group policy objects. Hopefully, this module will be
> notified if any admins add/delete/modify GPOs.
>
> Can anyone show me some pointers?

If yoiu're looking for some change control mechanism, AGPM (Advanced
Group Policy Management) from Microsoft is an app I'd look at. As for a
pointer to a GP change, have a look at the GPT.INI in SYSVOL, there's a
version number that indicates a change on the GP. It does not include a
pointer to what changed.

Cheers,
Florian

On Tue, 2 Feb 2010 13:51:30 -0800 (PST), Simon wrote:

> Hi all,
>
> I'm interested in developing a real-time monitor that saves all
> changes to group policy objects. Hopefully, this module will be
> notified if any admins add/delete/modify GPOs.
>
> Can anyone show me some pointers?

If you're willing to try some 3rd party tools, give this a shot:

http://www.netwrix.com/group_policy_..._freeware.html
http://www.netwrix.com/active_direct..._freeware.html

They're not realtime but you can set up a schedule to query changes more
frequently ...

If you really want to develop it, you could set up auditing, then monitor
the event log for group policy events and then compare the states (old vs
new) ...