Skills 101: Change Auditor | 5 Built-In Ways to Strengthen AD & Identity Security 

Most customers already run Change Auditor, but many aren’t using the built-in capabilities that actively stop attacks, modernize identity security, and reinforce ROI. While deployments often cover the basics, some of the most powerful security features go untouched simply because teams don’t realize what’s already available out of the box. In this session, we’ll walk through five high-impact configurations and event sets that significantly strengthen Active Directory and identity security using only native Change Auditor functionality.

You’ll learn how to:
• Guard the Crown Jewels: Detect unauthorized NTDS.DIT and Domain Controller access in real time
• Unmask Kerberos Manipulation: Identify SPN tampering and ticket abuse before  escalation
• Gain Total Privilege Visibility: Use a one-click view into Tier 0 administrator activity
• Hunt High-Signal Persistence: Monitor critical registry paths attackers rely on
• Stop Lateral Movement Early: Track local user and group changes on high-value servers