How to Audit GPO Changes

Group Policy Objects (GPOs) provide ways to effectively apply policies at scale, but this also means that small errors can have far-reaching consequences. Knowing how to audit GPO changes protects your infrastructure. And with the right tools, you can easily enforce version control and set alerts for continuous monitoring.

This article explains how to check GPO changes with built-in solutions, and highlights third-party Remote Monitoring and Management (RMM) tools that adapt to all your clients’ needs.

How to audit GPO changes for better traceability

While native tools can offer cost-effective solutions, consider expanding your toolkit for efficiency, and factor in your technical constraints before establishing audit workflows for clients.

📌 Prerequisites:

• Administrative privileges
• Domain and forest functional levels that support Advanced Audit Policy
• GPMC access for policy review and backup
• SIEM or Windows Event Collector infrastructure for log centralization
• A designated file share or repo for versioned GPO backups
• A change register template and owners for reviews and approvals

Step 1: Enable native auditing for policy changes

IT experts can track changes to GPOs and Organizational Units (OUs) using built-in Directory Service auditing on Domain Controllers. Here’s how:

📌 Use Cases: Use this to capture detailed logs of every GPO and OU change.

📌 Prerequisites: Windows server domain controllers, Education, or Pro; Local and domain administrative privileges.

💡 Note: These permissions correspond to audit categories that generate Event ID 5136 (Directory Service Object Modified) and similar events.

1. On a domain controller, press Win + R, type gpmc.msc, and press Enter to open the Group Policy Management Console (GPMC).
2. Create or edit a GPO linked to the Domain Controllers OU.
3. Navigate to:Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > DS Access

4. Enable the following policies:
   1. Audit Directory Service Changes → Success and/or Failure
   2. Audit Policy Change → Success and/or Failure
   3. Audit Account Management → Success and/or Failure
5. Apply the GPO. The settings will replicate to all Domain Controllers.
6. Use ADSIEDIT.msc to configure object-level auditing:
   1. Connect to the Default Naming Context.
   2. Locate your target container (e.g., OUs containing user policies).
   3. Right-click → Properties > Security tab > Advanced > Auditing tab.
   4. Add a Principal (e.g., Domain Admins, Authenticated Users).
   5. Select Success/Failure and check permissions such as:
      1. Create groupPolicyContainer objects
      2. Delete
      3. Modify Permissions
      4. Write versionNumber
7. Click OK to save.

💡Note:.On Windows 11, adsiedit.msc is only available if RSAT (Active Directory Domain Services Tools) has been installed through Optional Features or via Add-WindowsCapability.

Integrating endpoint solutions like NinjaOne boosts policy protection beyond native tools with premium features like real-time alerts and device health checks to help you audit GPO changes.

Step 2: Know the events that matter

Some events are more important than others when you audit GPO changes. As such, you’ll need to prioritize impactful signals to reduce alert fatigue.

Use these key Event IDs to filter out critical events and form a matrix that simplifies your Group Policy audit:

• GPO Changes:
  • 4739 – Domain Policy changed
  • 5136 – Directory Service object modified (includes GPO edits)
• OU Changes:
  • 5137 – Directory Service object created (OU created)
  • 5141 – Directory Service object deleted (OU deleted)
  • 5139 – Directory Service object moved (OU moved)
• Security Filter & Delegation:
  • 4670 – Permissions on an object changed
  • 4732/4733 – Security group membership changes (affecting GPO filtering and delegation)

Step 3: Centralize and protect the logs

Centralizing your logs across different Domain Controllers (DCs) with Windows Event Forwarding (WEF) can make evidence easier to query, improve visibility, and bolster compliance efforts as you audit GPO changes.

📌 Use Cases: To streamline log audits and support forensic investigations.

📌 Prerequisites: Administrative privileges, domain-joined systems, Windows Remote Management (WinRM) enabled.

1. Press Win + R, type cmd, and press Ctrl + Shift + Enter.
2. Run wecutil qc to set up the Windows Event Collector (WEC) service.
3. Press Win + R, type eventvwr.msc, and press Enter.
4. Expand Subscriptions.
5. Right-click and choose Create Subscription.
6. Name your subscription.
7. Set Destination Log to Forwarded Events.
8. Choose a subscription mode.
   1. In most domain environments, Source-Initiated is recommended unless you specifically need Collector-Initiated behavior.
9. Select events to collect (use XML tab for advanced filters).
10. On your Domain Controllers, run the following in the Command Prompt:

winrm qc

wecutil qc

11. Press Win + R, type gpedit.msc, and press Ctrl + Shift + Enter.
12. Navigate to:

Computer Configuration > Administrative Templates > Windows Components > Event Forwarding

13. Double-click Configure target Subscription Manager.
14. Set to Enabled, click Show, and add:

Server=http://<CollectorFQDN>:5985/wsman/SubscriptionManager/WEC,Refresh=60

Replace <CollectorFQDN> with your collector’s fully qualified domain name.

15. Run gpupdate /force to apply the policy.
16. Define Subscriptions.
    1. Baseline Subscription: Includes all devices for general monitoring.
    2. Suspect Subscription: Targets high-risk or anomalous devices for deeper logging.
17. Use PowerShell or your SIEM’s parsing tools to standardize fields such as:
    1. Editor Account
    2. Target Object Distinguished Name (DN)
    3. Change Type
    4. Originating DC
18. Retain logs for:
    1. Monthly reviews
    2. Quarterly reviews
    3. Incident investigations

Step 4: Back up, version, and diff GPOs

Prepare contingencies to enable safe rollbacks and technician-friendly version reviews as your teams audit GPO changes.

📌 Use Cases: Simplifying GPO change reviews for technicians for faster client reports.

1. Press Win + R, type gpmc.msc, and hit Enter.
2. Right-click Group Policy Objects and select Back Up All.
3. Choose a secure location (e.g., access-controlled share).
4. Form a GPO change register for auditability
   1. Track GPO name, version, editor, reason, and ticket ID.
5. Compare current settings to previous versions using the Group Policy Management Console (GPMC) for quick analysis.

Step 5: Alert on high-risk changes

Timely action is required when you audit GPO changes. Follow these best practices to optimize your process:

Auditing GPOs also plays a key role in optimizing identity infrastructure. According to a recent Forbes survey, 94% of organizations agree on the importance of Active Directory modernization, which involves continuous monitoring of GPO changes.

Step 6: Extend auditing to OUs and delegation

Organizational Units (or OUs) determine the scope of your policy and how it’s inherited. As you audit GPO changes, integrate OU creation, transfer, and removal events in your Group Policy audit for more comprehensive reports.

Doing so can also improve transparency and help uncover permission sprawl. Establish a regular cadence for GPO and OU reviews to ensure least-privilege practices are being applied.

NinjaOne integration simplifies OU change auditing

NinjaOne’s best-in-class RMM provides streamlined solutions for tracking fleet health and detecting policy drift. Here’s how NinjaOne helps you audit GPO changes:

Simplify GPO checks with endpoint solutions

Monitoring GPO modifications ensures compliance, operational resilience, and traceability. To audit GPO changes, use native directory and event logging, establish alerts through your SIEM or monitoring tools, review GPO link and scope changes using Group Policy Management, include OU activity for additional context, and report key metrics regularly to demonstrate control.

Related topics:

• What Is Group Policy in Active Directory?
• How to Apply Local Group Policies to Specific Users in Windows 11 and Windows 10
• An Overview of Group Policy Management Console: What You Need to Know