How to monitor Active Directory?

Question

Helpdesk

Hello!
A question of this nature: there is a pack of domain controllers, and a pack of people who have different privileges. The helpdesk has delegations to certain containers, the service desk has more delegations to containers, the verified ones have Enterprise admin rights.
Connoisseurs, attention, question: if someone nafakapit, from small to great, how to find out about it?
Does microsoft have ready-made solutions for auditing Active Directory?
Thank you.

Answer 1

ManageEngine: ADAudit Plus ( https://www.manageengine.com/products/active-direc... )
Dell: Change Auditor for Active Directory ( software.dell.com/products/change-auditor-for-acti... )
Netwrix: Netwrix Auditor ( www.netwrix.com/en/ad_audit.html )
BetondTrust: PowerBroker Auditor for Active Directory ( www.beyondtrust.com/Products/PowerBrokerAuditorAD )

Answer 2

Microsoft has SCOM, which includes a solution for collecting Security Logs. Actually, this is exactly what you need. Install SCOM agents on domain controllers, enable log forwarding, and use SQL Report Services to build any reports on actions in AD.

Answer 3

I did not see MS, SCOM is not quite suitable for these tasks.
Monitor AD with Netwrix active directory change reporter. Just right for your needs.