# Configure SCOM to monitor changes to security groups

**URL:** <https://community.squaredup.com/t/configure-scom-to-monitor-changes-to-security-groups/387>\
**Category:** Dashboard Server\
**Tags:** scom\
**Created:** [June 23, 2017, 1:52pm UTC](https://community.squaredup.com/t/configure-scom-to-monitor-changes-to-security-groups/387 "2017-06-23T13:52:44Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![scombledore12](https://community.squaredup.com/letter_avatar_proxy/v4/letter/s/35a633/32.png) [@scombledore12](https://community.squaredup.com/u/scombledore12)\
**Post date:** [June 23, 2017, 1:52pm UTC](https://community.squaredup.com/t/configure-scom-to-monitor-changes-to-security-groups/387/1 "2017-06-23T13:52:44Z")

</div>

The security team have a new audit requirement to monitor changes to critical AD groups (Domain Admins etc). Does the AD MP monitor this, and if not does anyone know how I could configure SCOM to do so?

---

<div class="post-metadata">

**Author:** ![dgallay](https://community.squaredup.com/letter_avatar_proxy/v4/letter/d/b4bc9f/32.png) [@dgallay](https://community.squaredup.com/u/dgallay)\
**Post date:** [June 23, 2017, 2:02pm UTC](https://community.squaredup.com/t/configure-scom-to-monitor-changes-to-security-groups/387/2 "2017-06-23T14:02:37Z")

</div>

We’ve been using a simple Eventlog Rule for critical groups adds / removes. Targeted at _Active Directory Domain Controller Computer Role_ (or a specific DC):

Log: _Security_

Expression:

_AND_

_EventID Equals 4728 (for Adds — 4729 for Removes)_

_OR GROUP_

_Parameter 3 Equals Group1_

_Parameter 3 Equals Group2_

etc

---

<div class="post-metadata">

**Author:** ![jannep](https://community.squaredup.com/user_avatar/community.squaredup.com/jannep/32/849_2.png) [@jannep](https://community.squaredup.com/u/jannep)\
**Post date:** [June 25, 2017, 4:10pm UTC](https://community.squaredup.com/t/configure-scom-to-monitor-changes-to-security-groups/387/3 "2017-06-25T16:10:37Z")

</div>

A bit more info regarding the event rule monitor solution:

[https://social.technet.microsoft.com/Forums/windowsserver/en-US/b3a7dc9c-3571-4275-8e24-2655e5fb9612/monitor-active-directory-group-changes?forum=winserverDS](https://social.technet.microsoft.com/Forums/windowsserver/en-US/b3a7dc9c-3571-4275-8e24-2655e5fb9612/monitor-active-directory-group-changes?forum=winserverDS)

---

<div class="post-metadata">

**Author:** ![wwzhang](https://community.squaredup.com/letter_avatar_proxy/v4/letter/w/ce7236/32.png) [@wwzhang](https://community.squaredup.com/u/wwzhang)\
**Post date:** [July 3, 2017, 7:18pm UTC](https://community.squaredup.com/t/configure-scom-to-monitor-changes-to-security-groups/387/4 "2017-07-03T19:18:38Z")

</div>

You should check out this: [https://blogs.technet.microsoft.com/nathangau/2017/05/01/introducing-the-security-monitoring-management-pack-for-scom/](https://blogs.technet.microsoft.com/nathangau/2017/05/01/introducing-the-security-monitoring-management-pack-for-scom/). This includes security group monitoring and other security checks.

---

<div class="post-metadata">

**Author:** ![rolltide](https://community.squaredup.com/letter_avatar_proxy/v4/letter/r/45deac/32.png) [@rolltide](https://community.squaredup.com/u/rolltide)\
**Post date:** [May 1, 2018, 4:06pm UTC](https://community.squaredup.com/t/configure-scom-to-monitor-changes-to-security-groups/387/5 "2018-05-01T16:06:58Z")

</div>

I’m struggling with how to present this data in Squared UP. Has anyone figured out the right criteria in a tile to display for example when someone gets added to the domain admins group? I’ve confirmed the alerts are in the SCOM DW using a SQL query as eventids 4728. I tried this but it’s showing nothing:

&nbsp;

AlertParams LIKE ‘%CORPORATE\Domain Admins%’ OR Description LIKE ‘%CORPORATE\Domain Admins%’

&nbsp;

even tried:

&nbsp;

(AlertParams LIKE ‘%CORPORATE\Domain Admins%’ OR Description LIKE ‘%CORPORATE\Domain Admins%’) AND (AlertParams LIKE ‘%4728%’ OR Description LIKE ‘%4728%’ )