Skip to main content

Active - Directory - GPO Modified

Summary​

This Custom RAWSQL monitor shows the GPO modified time on the computer if the GPO was modified in the last day.

Implementation​

  • Replace MonitorID in the additional condition with the ID of the monitor set.
    Image 1
    Image 2
  • Ensure that the monitor set is targeted on the Domain Controllers group.
    Image 3

Dependencies​

Target​

Domain Controller

Alert Template​

△ Custom - Ticket Creation - Computer

Ticketing​

Subject: GPO Modification detected on %COMPUTERNAME%

Ticket Body:

A GPO modification was detected on %COMPUTERNAME% for %DOMAIN%. Please review if necessary.
Number of GPO(s) Modified: %RESULT%
Details:  
%FIELDNAME%

%RESULT%: Total number of modified GPOs

%FIELDNAME%: GPO: Name of GPO (Modified Time: Modification Time of GPO)

Sample Ticket:
Sample Ticket Image

Changelog​

2025-02-17​

  • Initial version of the document