Event ID 4662: An operation was performed on an object
Written on domain controllers when an Active Directory object with auditing configured is accessed.
- Log
- Security
- Category
- Active Directory
Why it matters
- DCSync shows up here: replication rights (GUIDs starting 1131f6aa and 1131f6ad) used by an account that is not a domain controller.
- Very noisy; filter to the replication GUIDs and to non-DC accounts.
What to check
Check Properties for the replication GUIDs 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 and 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2, and the Subject account.
How to turn it on
Advanced Audit Policy on domain controllers: DS Access > Audit Directory Service Access, plus a SACL on the domain object.
MITRE ATT&CK
- T1003.006 DCSync