How to check who was recently added to a distribution list

A distribution group is an AD group that is set up to deliver mails to a distinct group of users. Since emails to a particular group of users could contain confidential information, a malicious insider could simply include themselves in the distribution list so that they can receive the information as well.

This makes it imperative for IT admins to monitor if any new users have been added to a new distribution group. The steps below show how you can track changes to a distribution list with native AD tools. Alternatively you can use the ADAuditPlus web console to find out who was added to a distribution list.

Free, fully functional 30-day trial

With Native AD Auditing
With ADAudit Plus

How to track new members added to a distribution list with ADAudit Plus
Select the Reports Tab and navigate to Group Management. You have a pre-configured report on Recently Added Members to Distribution Groups.
Select the Domain.
Customize the Period to desired time range. You can also define a custom period and save for quick reference.
A detailed audit information report is generated for the selected period.
Clicking on an event in the bar graph, filters the report view highlighting only the selected event.
Advanced filter attributes help you locate the specific event that youre looking for.

Step 1: Enable Group Policy Auditing
Launch the 'Server Manager' and open the Group Policy Management Console (GPMC).
In the left pane, expand the 'Forest' and 'Domains' nodes to reveal the specific domain you want to track the changes for.
Expand the domain and right click 'Default Domain Policy'. You can also choose a domain policy that is universal throughout the domain, or create a new GPO and link it to the Default Domain Policy.
Click on 'Edit' of the desired group policy, to open up the Group Policy Management Editor.
Expand 'Computer Configuration'--->Policies---->Windows Settings----->Security Settings----->Local Policies------->Audit Policies.
Enable 'success' and 'failure' for 'Audit account management' and 'Audit object access' policy properties. Exit Group Policy Management Editor.
In the GPMC choose the modified GPO, and click 'Add' in the 'Security' section on the right pane. Type 'everyone' in the text box and click 'Check Names' to include the value. Exit the GPMC.
To enforce these changes throughout the domain run the command 'gupdate /force', in the "Run" console.
Step 2: Allow AD Auditing through ADSI Edit
From your Server Manager go to Tools and select ADSI Edit.
Right click ADSI Edit node from the left pane and select Connect to option. This pulls up the Connection Settings window.
Select the Default Naming Context option from the Select a well-known Naming Context drop down list.
Click Okay and return to the ADSI Edit window. Expand Default Naming Context and select the associated 'DC' subnode. Right click this subnode and click 'Properties'.
In the Properties window, go to the Security tab and select Advanced. After that select Auditing tab and click Add.
Click on Select a principle. This will bring up a Select User, Computer or Group Window. Type 'Everyone' in the textbox and verify it with Check Names.
The principle in the Auditing Entry window now shows 'Everyone'. In the 'Type' drop-down select All to audit for both 'success' and 'failure' events.
In the Select drop-down choose This object and all descendant object's. This allows the auditing of the OU's descendant objects. Select Full Control in the 'Permissions' section.
This selects all the checkboxes available. Unselect the following check boxes:
1. Full Control
2. List Contents
3. Read all properties
4. Read permissions
You can view events in the 'Event Viewer'.You can access the 'Security Logs' under 'Windows Logs'.
Event ID 4728: A member has been added to a security-enabled group.
You can search for this event ID to check who added a user to a privileged account.

Does native auditing become a little too much?

Simplify distribution group auditing and reporting with ADAudit Plus.

Get Your Free Trial Fully functional 30-day trial

Active Directory auditing

Windows file auditing

NAS device file auditing

Windows server auditing

Workstation auditing

Entra ID auditing

All features →

Help documents

Video zone

Webinars

Product brochures

Case studies

E-books

Awards zone

Study

How tos

Best practices

How to check who was recently added to a distribution list

With Native AD Auditing

With ADAudit Plus

How to track new members added to a distribution list with ADAudit Plus

Step 1: Enable Group Policy Auditing

Step 2: Allow AD Auditing through ADSI Edit

Related How-tos

Request 1-on-1 demo

Thanks

ADAudit Plus Trusted By

Meet all auditing and IT security needs with ADAudit Plus.

A single pane of glass for complete Active Directory Auditing and Reporting

Identity and access management

Unified service management

Unified endpoint management and security

IT operations management and observability

Security information and event management

Advanced IT analytics

Low-code app development

Cloud solutions for enterprise IT

IT management for MSPs

Active Directory management Manage, track, and secure Active Directory

Identity governance and administrationOrchestrate user identity management and access controls for Zero Trust

Privileged access managementControl and secure privileged access to critical enterprise systems

Enterprise and IT service managementDeliver a consistent employee experience across business functions

Customer service managementBuild a one-stop portal for customers with efficient account management

IT asset managementCentralize and automate the complete IT asset life cycle

SIEM Spot, investigate, and neutralize security threats

Log and compliance managementGain deeper visibility into security events and ensure compliance

Security auditingAudit Active Directory, cloud platforms and files to enhance your security posture

Endpoint management and protection platform (UEM and EPP)Secure and manage endpoints to protect your IT assets effectively

Endpoint managementAchieve intelligent IT device management with zero user intervention

Endpoint securityDefend against threat actors with proactive and reactive measures

Full-stack observability and digital experience monitoringAchieve end-to-end visibility, proactive issue resolution, and enhanced security

Network and server performance monitoringEnsure network, server, and storage reliability with AI-powered insights

IT incident managementEfficiently manage and resolve IT incidents while ensuring transparency

DNS and DHCP managementOptimize IP address and domain management

Cloud cost managementRight-size and take control of your cloud costs

IT analyticsConnect to your IT applications and visualize all facets of your IT

Cloud-native solutions for IT managementMonitor, manage, audit, and secure your multi-cloudand hybrid infrastructure

Business applications for ITBoost productivity and improve team collaboration

Custom solution builderBuild tailor-made apps to automate operations at your organization

Solutions for MSPsGrow your MSP business with scalable and secure IT management solutions

How to check who was recently added to a distribution list

With Native AD Auditing

With ADAudit Plus

How to track new members added to a distribution list with ADAudit Plus

Step 1: Enable Group Policy Auditing

Step 2: Allow AD Auditing through ADSI Edit

Related How-tos

Request 1-on-1 demo

Thanks

ADAudit Plus Trusted By

Meet all auditing and IT security needs with ADAudit Plus.

A single pane of glass for complete Active Directory Auditing and Reporting

Active Directory
management Manage, track, and secure Active Directory

Identity governance
and administrationOrchestrate user identity management and access controls for Zero Trust

Privileged access
managementControl and secure privileged access to critical enterprise systems

Enterprise and IT service
managementDeliver a consistent employee experience across business functions

Customer service
managementBuild a one-stop portal for customers with efficient account management

IT asset
managementCentralize and automate the complete IT asset life cycle

Network and server
performance monitoringEnsure network, server, and storage reliability with AI-powered insights

IT incident
managementEfficiently manage and resolve IT incidents while ensuring transparency

Cloud-native solutions for IT managementMonitor, manage, audit, and secure your multi-cloud
and hybrid infrastructure