Steps to enable auditing using GPMC

In order to monitor FSMO role changes, you first need to enable auditing for these changes. To do this, perform the following actions on the DC:

1. Go to Start > Group Policy Management Console. You can also run the command gpmc.msc with elevated privileges.

2. Right-click the domain or organizational unit (OU) where you want to audit FSMO role changes, select Create a GPO in this domain, and Link it here..., and name it.

Note: If you want to link the auditing policy to an existing GPO, select Link an Existing GPO...


3. Right-click the GPO, and choose Edit. This opens up the Group Policy Management Editor.

4. In the left pane of the Group Policy Management Editor,navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > DS Access.

5. In the right pane, you will see the following policies that are under DS Access:
   • Audit Detailed Directory Service Replication
   • Audit Directory Service Access
   • Audit Directory Service Changes
   • Audit Directory Service Replication

Double-click each of the audit policies, and check the boxes labeled Configure the following audit events, Success, and Failure.


6. Click Apply and then OK.

Steps to view FSMO role change events using Event Viewer:

Perform the following actions on the DC:

1. Click Start, search for Event Viewer, right-click it, and select Run as administrator.
2. On the left pane in the Event Viewer window, navigate to Applications and Services Logs > Directory Service.

3. On the right pane under Actions, click Filter Current Log....
4. In the pop-up window, enter the Event ID 1458 in the field labeled <;All Event IDs>.

5. Click OK.This will give you a list of occurrences of Event ID 1458. Double-click on the Event ID to view its properties.

Though Windows' native auditing allows you to look for changes in the FSMO roles, it becomes strenuous and often impossible to manually analyze and investigate changes on a large scale. In such scenarios, you need an intuitive and interactive solution that can monitor and alert you about the changes, and provide you with exhaustive reports on the change action.

ADAudit Plus is a real-time AD change auditing solution that comes with prebuilt reports for all AD changes including FSMO role changes.