Microsoft login tracking: setup and minimum permissions

GUI — administrator setup

1. Open Server Manager → Tools → Active Directory Users and Computers (dsa.msc). Expand your domain and choose the approved service-account OU. The demo uses the Users container.
2. Right-click that OU/container → New → User. Set display name ZenPlus UDT Reader and user logon name svc_zenplus_udt. Use your own AD domain suffix.
3. Set a strong unique password privately. Clear User must change password at next logon so unattended collection can authenticate. Keep the account enabled and use your organization’s service-account rotation policy; do not make Password never expires a requirement.
4. Open the new user’s Properties → Member Of → Add. Add Event Log Readers and Remote Management Users. Use Check Names, then save. Keep Domain Users as the primary group.
5. Verify that the account has no direct or nested administrative group membership. It does not need interactive or RDP sign-in rights.

PowerShell — administrator setup

# Run locally as an AD administrator with delegated user/group setup rights.
Import-Module ActiveDirectory
$Account = 'svc_zenplus_udt'
$DnsDomain = 'example.test'                 # replace
$ApprovedOU = 'OU=Service Accounts,DC=example,DC=test' # replace
$Password = Read-Host 'Service-account password' -AsSecureString
New-ADUser -Name 'ZenPlus UDT Reader' -DisplayName 'ZenPlus UDT Reader' `
  -SamAccountName $Account -UserPrincipalName "$Account@$DnsDomain" `
  -Path $ApprovedOU -AccountPassword $Password -Enabled $true `
  -ChangePasswordAtLogon $false
# Well-known SIDs work independently of localized group names.
Add-ADGroupMember -Identity 'S-1-5-32-573' -Members $Account # Event Log Readers
Add-ADGroupMember -Identity 'S-1-5-32-580' -Members $Account # Remote Management Users
Get-ADPrincipalGroupMembership $Account | Select-Object Name

GUI — administrator setup

1. Open Group Policy Management (gpmc.msc). Edit an approved policy linked to the Domain Controllers OU and scoped to the selected controllers. Follow your organization’s change process.
2. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies.
3. Under Logon/Logoff → Audit Logon, configure Success. Under Account Logon, configure Success for Audit Kerberos Authentication Service and Audit Kerberos Service Ticket Operations. Preserve any existing Failure auditing.
4. Apply the approved policy. Check effective results with auditpol on each selected DC; an editor setting alone does not prove which policy won.
5. Open Event Viewer → Windows Logs → Security → Filter Current Log. Enter event IDs 4624,4768,4769. Inspect recent Audit Success events after a normal approved domain authentication.

PowerShell — administrator setup

# Read effective policy on each DC (English subcategory names).
auditpol /get /subcategory:'Logon'
auditpol /get /subcategory:'Kerberos Authentication Service'
auditpol /get /subcategory:'Kerberos Service Ticket Operations'
# Only if local audit policy is approved and not controlled by central GPO:
auditpol /set /subcategory:'Logon' /success:enable
auditpol /set /subcategory:'Kerberos Authentication Service' /success:enable
auditpol /set /subcategory:'Kerberos Service Ticket Operations' /success:enable
# These /set commands retain the existing Failure setting.
Get-WinEvent -FilterHashtable @{
  LogName='Security'; Id=4624,4768,4769; StartTime=(Get-Date).AddMinutes(-30)
} -MaxEvents 10 | Select-Object TimeCreated,Id,RecordId

GUI — administrator setup

1. On the selected DC, open Server Manager → Local Server and inspect Remote management. Confirm WinRM is enabled under the approved server policy. Check the actual listener with winrm enumerate winrm/config/listener. A running service alone does not prove that a listener exists.
2. For HTTPS 5986, obtain an approved Server Authentication certificate for the DC FQDN with a private key. Open certlm.msc → Personal → Certificates, import it if necessary, and verify its name, validity and intended purpose. Configure the listener with the PowerShell example below.
3. Open Windows Defender Firewall with Advanced Security (wf.msc) → Inbound Rules → New Rule → Custom. Select TCP and the chosen port. In Scope, allow the appliance’s actual source IP. Allow the connection on the approved Domain profile and name the rule clearly.
4. Review existing firewall/GPO/network rules: an additional narrow rule does not override another broad Allow rule. Preserve other management tools and existing approved listeners.

PowerShell — administrator setup

# Inspection: no configuration changes.
Get-Service WinRM
winrm enumerate winrm/config/listener
winrm get winrm/config/service

# Approved HTTPS setup only after PKI has issued the correct certificate.
$DcFqdn = 'dc01.example.test'               # replace
$Thumbprint = '<APPROVED_CERTIFICATE_THUMBPRINT>'
$ApplianceIP = '192.0.2.20'                 # replace with egress IP
Get-Item "Cert:\LocalMachine\My\$Thumbprint" |
  Format-List Subject,DnsNameList,NotAfter,HasPrivateKey
Set-Service WinRM -StartupType Automatic
Start-Service WinRM
# Create only if a suitable HTTPS listener does not already exist.
New-Item -Path WSMan:\localhost\Listener -Transport HTTPS -Address '*' `
  -Hostname $DcFqdn -CertificateThumbprint $Thumbprint
New-NetFirewallRule -DisplayName 'ZenPlus UDT WinRM HTTPS' -Direction Inbound `
  -Action Allow -Protocol TCP -LocalPort 5986 -RemoteAddress $ApplianceIP `
  -Profile Domain

GUI — administrator setup

1. From an elevated command prompt on the selected DC, run winrm configsddl default. This opens Permissions for Default.
2. If the dedicated account already has the required effective access, retain it. Otherwise click Add, select your domain, enter svc_zenplus_udt, use Check Names and confirm that this is the dedicated account.
3. Select that account. Allow Read (Get, Enumerate, Subscribe) and Execute (Invoke) only. Leave Write and Full Control unchecked. Preserve every existing unrelated permission entry.
4. Save the approved grant and test a fresh connection from ZenPlus. Repeat on each selected DC; do not grant it globally to all domain users.
5. Verify Security-channel Read using the command below and the appliance’s Security event-log check. Do not grant Manage auditing and security log to make a read query succeed.

PowerShell — administrator setup

# Read-only Security-channel check: Event Log Readers SID should have Read (0x1).
wevtutil gl Security
# Inspect the WinRM service descriptor.
Get-Item WSMan:\localhost\Service\RootSDDL

# Apply only on approved selected DCs when the account lacks effective access.
# Run elevated as the setup administrator, not the collector.
$Account = 'svc_zenplus_udt'
$Sid = (Get-ADUser $Account).SID
$Before = (Get-Item WSMan:\localhost\Service\RootSDDL).Value
# Keep a protected copy of $Before in your change record for rollback.
$Descriptor = [System.Security.AccessControl.CommonSecurityDescriptor]::new(
  $false,$false,$Before)
$ReadExecute = [int]-1610612736 # GR | GX, signed 0xA0000000
$Descriptor.DiscretionaryAcl.AddAccess(
  [System.Security.AccessControl.AccessControlType]::Allow,
  [System.Security.Principal.SecurityIdentifier]$Sid,
  $ReadExecute,
  [System.Security.AccessControl.InheritanceFlags]::None,
  [System.Security.AccessControl.PropagationFlags]::None)
$After = $Descriptor.GetSddlForm(
  [System.Security.AccessControl.AccessControlSections]::All)
Set-Item WSMan:\localhost\Service\RootSDDL -Value $After -Force
# Verify the actual account from the appliance; do not replace the whole ACL.

PowerShell / command-line — optional connection diagnostic

# Optional diagnostic from a domain-joined Windows validation host.
# runas prompts for the password; no password argument is used.
runas /netonly /user:EXAMPLE\svc_zenplus_udt cmd
# In the new command window, exercise Windows Shell and Security read:
winrs /r:https://dc01.example.test:5986 /noprofile powershell.exe -NoProfile -NonInteractive -Command "Get-WinEvent -LogName Security -MaxEvents 5 | Select-Object TimeCreated,Id,RecordId"
# If testing the approved encrypted HTTP alternative, use its http:// URL/5985.
# Do not add /unencrypted. The appliance test is the final connection check.

GUI — administrator setup

1. Open Device Tracker → Tracker Settings → Active Directory controllers → Add DC.
2. Set a recognizable Name and the same approved Host / IP used in the credential test. Choose the tested dedicated-account Windows credential. Start with a 300-second poll interval.
3. Click Add once for that selected DC. Avoid duplicate enabled entries for the same controller. Repeat for the other DCs whose Security events you need.
4. Use the controller’s Poll now action. Verify status ok, a recent Last poll and no error. A successful zero-event poll is valid when no matching events exist in the collection window.
5. Using an approved test user on a known domain workstation, perform a normal domain authentication. Record its client IP, source DC and time. After a collection cycle, open User Logins and search that username.