Audit Evidence After Suspected Insider Access
Coastal Retail has 5,000 secrets and 400 Secret Server users. After a suspected insider event, the security manager asks for every access to the Domain Admin - Production secret in the last 90 days, every password change on that secret, and the approvers for all access requests. The Secret Server administrator finds the built-in secret audit view is complete for 30 days, but older records are not in the UI because the company set audit data retention to 30 days. The SIEM team says it can receive syslog but has not been configured for Secret Server. The auditor also wants evidence that access to the audit function itself is restricted. The company uses on-premises Secret Server and has a change freeze on the database.
1. What reports or audit views do you use, and what are their limits?
Read the worked answer
Use the Secret Audit report filtered to the Domain Admin - Production secret to show access, view, edit, checkout, and password-change events on that secret. Use the User Audit report to pivot on specific users and see all their activity. Use the access-request and approval reporting to identify approvers and decisions, and use password-change reporting to corroborate RPC events. The critical limit is retention: if audit data was purged after 30 days, the UI cannot reconstruct the missing 60 days. Before concluding, check whether database backups from the 90-day period exist and can be restored to an isolated, non-production instance for forensic review; do not alter production during the change freeze. Export what exists with timestamps and a chain-of-custody note. Do not claim completeness the data cannot support.
2. How do you meet the 90-day requirement going forward?
Read the worked answer
Treat the 30-day UI retention as the root cause. Increase audit retention if the platform and database capacity allow, and confirm the setting with a test event older than the current window. Configure syslog forwarding to the SIEM so audit events leave Secret Server promptly and are retained independently. Define which event types are forwarded, test ingestion, and monitor for gaps. Schedule the relevant reports to run and export before the retention boundary as a secondary control. Ensure time synchronization so SIEM and Secret Server timestamps correlate. Document the retention policy and legal-hold process. Do not rely on report scheduling alone, because a missed schedule creates a permanent gap; syslog plus retention change is stronger.
3. How should access to the audit function itself be restricted and evidenced?
Read the worked answer
Create a dedicated audit role that can view audit records and reports but cannot view or edit secret contents. Assign it to a small AD group of auditors or security staff, not to all Secret Server administrators. Keep Secret Server administration in a separate role so a system administrator cannot silently change audit settings without another group's involvement. Review the membership of the audit role quarterly and audit changes to that membership. Export a report showing who has the audit role and when it was last reviewed. This provides separation of duties and answers the auditor's question directly, while preserving the investigators' ability to review activity without giving them standing access to every privileged credential.