Auditing and Monitoring AD Connector Login Events
This article will show you how to audit AD Connector login events to your Amazon WorkSpaces Personal environment. This can assist with security and with root cause analysis of issues.
Optional Prerequisite: Create an IAM role for SSM Fleet Manager
Create the Windows Event Collector EC2 instance
Install the Group Policy Management MMC
Enable auditing of login events
Create the Event Log Subscription
Create the Event Log Forwarding Group Policy
Rolling back the Event Log Forwarding Group Policy
us-east-1
pricing. This solution does not require a dedicated instance, but this article will use one for demonstration purposes.- You will create a new EC2 Windows instance on a
t3.medium
instance. This instance will be joined to the same Active Directory domain as your WorkSpaces. - Next, you will create a Group Policy for your domain controllers which will enable additional audit logging for login events.
- You will create a Windows Event Log Collection Subscription on that new instance, in order to receive those advanced login events.
- You will then use Group Policy to configure your domain controllers to forward the advanced login events to the collector server.
- Lastly, you will intentionally generate an invalid login attempt to one of your WorkSpaces, so that you can see an example event log entry.
- A pre-existing AD Connector setup with WorkSpaces Personal.
- Your domain needs WinRM enabled and preconfigured. The Event Log Forwarding depends on this already being in place.
- See Enabling Windows Remote Management with Amazon WorkSpaces and Amazon AppStream 2.0 if you have not yet configured WinRM.
- Permissions to create a new EC2 instance, joined to your Active Directory domain.
- Familiarity with Group Policy and Active Directory
- Permissions to create Group Policy in your domain which will apply to domain controllers.
- From the IAM console, choose Roles, then choose Create role.
- On the Select trusted entity page, select AWS service. Select EC2 in the Service or use case dropdown menu. Under choose a use case for the specified service, select EC2. Then choose Next.
- On the Add permissions page, select Next without choosing any policies. You will create the IAM policy in a later step.
- On the Name, review, and create page, enter a name and description for the role. The name can be something like “SSMConnectionRole”. Optionally, add tags to the role. Select Create role.
- In the list of IAM roles, find the role you just created and select it.
- Select the Add permissions dropdown menu and choose Create inline policy.
- In the resulting Specify Permissions page, select the JSON tab. Delete the pre-existing contents of the JSON policy editor and replace them with the JSON below, and then choose Next.
- Enter a policy name, such as SSMConnectionInline, and select Create policy.
- From the EC2 console, select Instances (running) then select Launch Instances.
- Provide a name for your instance, such as: WindowsEventLogCollector
- From the Quick Start section, select Windows then select Microsoft Windows Server 2022 Base from the Amazon Machine Image (AMI) dropdown.
- Under Instance Type select
t3.medium
. If you desire, you may use a larger instance type, but the pricing example in the overview is based ont3.medium
in theus-east-1
region. - Key pair (login): Select a key pair you have access to or select Create a new key pair to create a new one.
- In the Network Settings section, use the following options:
- VPC: Choose the VPC for your Amazon WorkSpaces.
- Subnet: Choose a private subnet your WorkSpaces VPC.
- Auto-assign public IP: disabled
- Firewall (security groups): Choose the Select existing security group radio button and select an existing Security Group with default outbound rules, which permits access to the internet. The VPC default security group will work.
- Configure storage: Expand this to 40 GB. Encryption is optional based on your organization’s policies.
- Expand the Advanced Details tab.
- In the Domain join directory dropdown, select the AD Connector. If you have multiple unique Fully Qualified Domain Names, select the directory your WorkSpaces use.
- Optional: If you plan to connect to the instance with SSM Fleet Manager, you must attach an IAM role with the relevant permissions. Select the IAM instance profile drop down menu. Choose an appropriate role. This could be a pre-existing one in your account. Otherwise, it will be the one you created in the section Optional Prerequisite: Create an IAM role for SSM Fleet Manager.
- Select Launch instance.
- Select the instance in the EC2 console
- Select the “Actions” drop down menu in the top right
- Select Connect
- Select the “RDP Client” tab, and then the “Connect using Fleet Manager” radio button
- Select the “Fleet Manager Remote Desktop” button on the bottom.
- When prompted for credentials, enter them in a domain format. You can use either
domain\username
orusername@domain.tld
as the format.
Install-WindowsFeature -Name GPMC
gpmc.msc
in the PowerShell window and press Enter to launch the Group Policy Management window. You will use this MMC in subsequent sections.- You will see this event on all successful logins. When a user logs into the WorkSpaces client on an AD Connector directory, the AD Connector service requests a Kerberos Ticket Granting Ticket to facilitate the login.
- You will see this on unsuccessful logins, such as user entering the wrong password.
gpmc.msc
– complete the following steps.- In the left column, expand the Forest folder, then Domains, and then the domain name. You should see a list of your OUs.
- Right select the “Domain Controllers” OU. Select “Create a GPO in this domain, and Link it here…” Enter a name for your Group Policy, such as “AD Audit Logging” and press Enter.
- Right select your new Group Policy Object and select “Edit…”
- In the resulting Group Policy Management Editor window, expand Computer Configuration, Policies, Windows Settings, Security Settings, Advanced Audit Policy Configuration, Audit Policies, and then select the Account Logon section.
- Select “Audit Kerberos Authentication Service” in the right section, and select the Success and Failure boxes. Select OK to close the properties window.
- Open
eventvwr.msc
- Right-select “Subscriptions” in the left column and choose “Create Subscription…”
- Enter a name and description, such as “AD Connector Events” and “Collects event logs related to AD Connector user login activity.”
- For “Destination log:” choose “Forwarded Events”.
- For the Subscription type and source computers section:
- Choose the “Source computer initiated” radio button.
- Choose “Select Computer Groups”
- In the resulting window, select “Add Domain Computers”.
- Type “Domain Controllers” into the box and press “Check Names”. It should underline. Press OK, and then OK a second time to close the window.
- Press "Select Events…”
- In the query filter, choose:
- By log: Security
- Under the "includes/excludes Event IDs" box, enter 4768,4771,4772
- Check all 5 boxes at the top as well - Critical, Warning, Verbose, Error, and Information.
- Select “OK” to close the query filter box.
- Select “OK” to finalize the Subscription Properties box.
Server=http://REPLACEME:5985/wsman/SubscriptionManager/WEC,Refresh=60
[System.Net.Dns]::GetHostByName($env:computerName).HostName | clip
Server=http://EC2AMAZ-IJ1P3E1.example.com:5985/wsman/SubscriptionManager/WEC,Refresh=60
gpmc.msc
– complete the following steps.- In the left column, expand the Forest folder, then Domains, and then the domain name. You should see a list of your OUs.
- Right select the “Domain Controllers” OU. Select “Create a GPO in this domain, and Link it here…” Enter a name for your Group Policy, such as “AD Connector Event Log Forwarding” and press Enter.
- Right select your new Group Policy Object and select “Edit…”
- In the resulting Group Policy Management Editor window, expand Computer Configuration, Policies > Administrative Templates > Windows Components > Event Forwarding, and then select the Configure target Subscription Manager section.
- In the resulting window, choose the Enabled radio button. In the bottom left section, you will see SubscriptionManagers and a Show… button to the right. Select the Show… button.
- In the resulting Show Contents window, you will see a blank Value column. Paste the string you crafted above, into this field. Then select OK on the Show Contents and Configure target Subscription Manager windows.
- In the Group Policy Management Editor window, expand the Event Log Service section in the left column, and select the Security folder.
- In the right column, select Configure log access.
- In the resulting Configure log access window, select the Enabled radio button. In the “Log Access” field in the bottom left, paste the following string:
O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;NS)
NT AUTHORITY\NETWORK SERVICE
account to read the Security event log, which it doesn’t have permissions to do by default. If you would like to see this in a more human readable format, you can use the ConvertFrom-SddlString
PowerShell cmdlet (available in PowerShell 7 and beyond) to read this. Here is the output of that command:gpupdate /force
in an administrative PowerShell or Command Prompt window on each domain controller to ensure this happens immediately. The default refresh interval is every 90 minutes, with a randomized offset of up to 30 minutes.eventvwr.msc
under the Forwarded Events section.Network Information
field is showing you an IPv4 address of 10.0.0.24
. This is not the IP address of the end user’s device, where the connection attempt came from. It is the IP address of one of your two AD Connector instances.- An incorrect password attempt was made on behalf of this particular user.
- The login attempt was processed by the domain controller
EC2AMAZ-J1QL8QP.corp.example.com
.
gpmc.msc
– complete the following steps.- In the left console, expand Forest, Domains, and your domain Fully Qualified Domain Name. Locate the Organization Unit you identified in the previous section.
- In your Domain Controllers OU, you will see the AD Audit Logging GPO you created previously. Right select this and choose Delete.
- Open an admin PowerShell prompt
- Run
gpupdate /force
- Run
wevtutil gl security
in order to validate that thechannelAccess
value has returned to its default.- For reference, the default value is:
O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)
- Now open the Event Viewer –
eventvwr.msc
- In the left column, expand Applications and Services Logs > Microsoft > Windows > Eventlog-ForwardingPlugin and select Operational.
- In the right section, you should see a fresh entry for Event ID 103, showing that the subscription is unsubscribed.
gpmc.msc
– complete the following steps.- In the left console, expand Forest, Domains, and your domain Fully Qualified Domain Name. Locate the Organization Unit you identified in the previous section.
- In your Domain Controllers OU, you will see the AD Audit Logging GPO you created previously. Right select this and choose Delete.
gpupdate /force
on a domain controller and looking at the Security event log in the Event Viewer. You should see Event 4179, indicating an Audit Policy Change, showing the events were removed.Any opinions in this post are those of the individual author and may not reflect the opinions of AWS.