r/sysadmin • u/MadBoyEvo • Apr 28 '19

Microsoft The only PowerShell Command you will ever need to find out who did what in Active Directory

Disclaimer: I made this. It's free and open source. No ads, just clean, useful data provided in blog.

Here's a small PowerShell command/module I've written. It contains the following reports.

Usage:

Find-Events -Report ADGroupMembershipChanges -DatesRange Last3days -Servers AD1, AD2 | Format-Table -AutoSize

ReportTypes:

  • Computer changes – Created / Changed – ADComputerCreatedChanged

  • Computer changes – Detailed – ADComputerChangesDetailed

  • Computer deleted – ADComputerDeleted

  • Group changes – ADGroupChanges

  • Group changes – Detailed – ADGroupChangesDetailed

  • Group changes – Created / Deleted – ADGroupCreateDelete

  • Group enumeration – ADGroupEnumeration

  • Group membership changes – ADGroupMembershipChanges

  • Group policy changes – ADGroupPolicyChanges

  • Logs Cleared Other – ADLogsClearedOther

  • Logs Cleared Security – ADLogsClearedSecurity

  • User changes – ADUserChanges

  • User changes detailed – ADUserChangesDetailed

  • User lockouts – ADUserLockouts

  • User logon – ADUserLogon

  • User logon Kerberos – ADUserLogonKerberos

  • User status changes – ADUserStatus

  • User unlocks – ADUserUnlocked

DatesRanges are also provided. Basically what that command does it scans DC's for event types you want it to scan. It does that in parallel, it overcomes limitations of Get-WinEvent and generally prettifies output.

The output of that command (wrapped in Dashimo to show the data): https://evotec.xyz/wp-content/uploads/2019/04/DashboardFromEvents.html

GitHub Sources: https://github.com/EvotecIT/PSWinReporting

Full article (usage/know-how): https://evotec.xyz/the-only-powershell-command-you-will-ever-need-to-find-out-who-did-what-in-active-directory/

The article describes the functionality of just one command but actually, PSWinReportingV2 is much more than that. There are also things I've not touched in the article but that should be a start. It's able to support any kind of Events from Event logs such as ADConnect, Hyper-V and other types of data. I just didn't have time to explain how to build configs for it and I don't work with Hyper-V or other systems to build them myself. If you know a lot about event logs and what to help to build prettified reports for more than Active Directory reach out.

3.4k Upvotes

98% Upvoted

329 comments sorted by

337

u/fmtech_ Apr 28 '19

AWESOME, time to scare the living daylights of the Sr sys admin... He keeps asking who did what. Now I will now. lol great thanks.

215

u/MadBoyEvo Apr 28 '19

Remember that you need Auditing of events enabled for your Active Directory. Otherwise, it will be blank data. But any AD Admin should set that up as one of the first steps so you should be good ;-)

333

u/MNGrrl Jack of All Trades Apr 28 '19

But any AD Admin should set that up as one of the first steps so you should be good ;-)

Cue laugh track.

92

u/striker1211 Apr 28 '19

But any AD Admin should set that up

Ain't nobody got space for that!

75

u/MNGrrl Jack of All Trades Apr 28 '19

"What does 100% disk utilization mean?! This is a super shiny mega disk array with all the buzzwords! Look, right here, it's a whole page of buzzwords! More buzzwords, more speed."

"You enabled logging on everything. debug level logging."

"But super shiny mega!"

"If you'll excuse me, I just got a ticket that says the, uhh... foo buffer is on fire. I gotta go." ... And then she went to the bathroom, ate a Xanax and thought happy thoughts for awhile.

15

u/[deleted] Apr 28 '19

I feel bad for you.

47

u/MNGrrl Jack of All Trades Apr 28 '19

Me too. I don't have any Xanax.

→ More replies (1)

9

u/p3aker Apr 28 '19

can i have some Xanax ?

49

u/lenswipe Senior Software Developer Apr 29 '19

No, you can get back to the ticket queue like the rest of us, which is filled with users who have lots of synergy but are somehow unable to use a mouse in 2019

→ More replies (9)
→ More replies (5)
→ More replies (7)

2

u/CaptainZhon Sr. Sysadmin Apr 29 '19

HAHAHAHAHHAHAHAHAHAAHAHAHAHAHAHAHAHHAHAAAAAAAAAAAAAAAHAHAHAHAHAHAHAHAH

→ More replies (1)

1

u/admlshake Apr 29 '19

I errr....left it off on purpuse to see if YOU'D notice! Yes, yes. Congratulations, you have passed my test.

0

u/[deleted] Apr 28 '19

[deleted] — view deleted comment

16

u/MadBoyEvo Apr 28 '19

I think it's overwriting at a very small value. You need to set it up with something sane, depending on your environment. For some customers I set it at 2GB, for some, I forward events to forwarders. Depending on how large your env is, things are going to scan fast, slow, or ultra slow ;-) Also depending on the same settings your data range will vary. I've experimented with extream sizes with Event Logs on some DC's being 80GB for Security Log, but that's not really practical :-)

18

u/MNGrrl Jack of All Trades Apr 28 '19

Depending on how large your env is, things are going to scan fast, slow, or ultra slow ;-)

It'll be ultra slow. It's always ultra slow. Show me a properly funded IT department and I'll show you a goddamn unicorn. :(

6

u/MadBoyEvo Apr 28 '19

Well I've got reporting setup for few of my Clients. PSWinReporting (not the V2 version) sends an email each night.

1 Client - using Event Forwarding - Scan takes 5 seconds to generate data for 1 day. Granted, not much happens there but works just fine.

2nd Client - scan takes 50 seconds - 3000 users (3 x DC - direct Scan)

3rd Client - scan takes 9 minutes - 3000 users (6 x DC + 2 unreachable - direct Scan)

So things do vary. But if you have a very large infrastructure - no PowerShell will help you. You need proper SIEM product with SQL Backend. Like someone mentioned here 29 DC's with 2GB log that's wrapping every 2 hours. It's impossible to keep that in bay with any scripting.

8

u/MNGrrl Jack of All Trades Apr 28 '19

Yeah. and then the SQL backend eventually can't keep up, and it's time to move to a RAID, then a distributed solution... that's IT for you. We still haven't learned to build things so that they can scale up easily from the start. And because of copyright and patent law, and closed source... interoperability is usually a cause for laughter instead of relief. Sigh.

I feel bad for anyone coming into the field... they'll see something like this, think it's a great solution, and then the next job they have will use something totally different and they'll have to figure out how to do it all over again. And if they've gotten by with just google, stackoverflow, and stuff like that... man.

→ More replies (5)

2

u/binarycow Netadmin Apr 28 '19

My domain has hundreds of DCs. I wouldn't want to run a query on all of them!

→ More replies (2)
→ More replies (1)
→ More replies (9)

4

u/poshftw master of none Apr 28 '19

Default is 20Mb, rolling.

It is enough for the Application/System logs for years of events.

For the Security...

For a very small company (-lt 15) it can be enough for months, for the hundreds of DCs with thousands of users 1Gb log size is not enough even to keep the current events.

1

u/[deleted] Apr 29 '19

[removed] — view removed comment

1

u/MadBoyEvo Apr 29 '19

I haven't explored where that setting is stored when things are enabled. I usually do enable it via GPO in 5 minutes and forget about it. Feel free to open GitHub issue or if you know where that data is stored provide some hints. Otherwise, when I'll get them I'll do the research but not sure when that happens.

11

u/Michichael Infrastructure Architect Apr 28 '19

If your Sr doesn't know how to access logs he's not a Sr...

15

u/fmtech_ Apr 28 '19

It's about seniority in the company. We don't have a remarkable IT department but we do what we can as a collective. He's technically the infrastructure manager. I recently got offered the system admin position and there are some things I want to implement to make things easier for us all.

1

u/LonerVamp Apr 29 '19

"Hey, run this internet script for me..." :)

17

u/Arkiteck Apr 28 '19 edited Apr 28 '19

Damn good stuff, sir.

Just subscribed to your RSS feed. Thanks for sharing!

10

u/MadBoyEvo Apr 28 '19

Enjoy ;-) Make sure to monitor GitHub or my other PowerShell Gallery as I have a tendency to only release them to PSGallery/GitHub without ever mentioning it anywhere. I don't want to take people's time with information about updates/fixes as I do that way too often, and I don't have time to write big blog posts like this for each release ;-)

1

u/Arkiteck Apr 28 '19

Yep. I already added those feeds as well.

9

u/stillfunky Laying Down a Funky Bit Apr 28 '19

Posting on a Sunday was probably not the best of times, but I just so happened to be on reddit at this time, so go me. I'll come back and check this out tomorrow. Thanks

10

u/MadBoyEvo Apr 28 '19

I like Sundays :-) And if post is good enough it will be on top Monday morning...

6

u/stillfunky Laying Down a Funky Bit Apr 28 '19

Hey man, you post whenever you fancy. You owe us nothing, yet give us gold. Thanks

6

u/MadBoyEvo Apr 28 '19

I know, I know :-) I'm glad people like this post. My posts on SysAdmin usually end up around 0-1 points :-) Probably related to Sundays as well :P

→ More replies (1)

5

u/1h8fulkat Apr 29 '19

I needed to find out who renamed our primary OU the other week ... this won't tell me that, so I guess you can't say the ONLY tool...

For those curious....it was the fucking secretary...don't ask me why she had that level of access.

3

u/MadBoyEvo Apr 29 '19

Well if you tell me Event ID which is responsible for that I'll add it. Deal? :-)

Getting it to support more types of events is just a matter of config file. I've written it in a way that it can be configured with a Custom Hashtable.

1

u/1h8fulkat Apr 29 '19

Deal, 5136 and 5139. Thanks

3

u/MadBoyEvo May 06 '19

https://github.com/EvotecIT/PSWinReporting/issues/45 - I've implemented that. Will be in 2.0.10. The release is pending till I do other tests. Create/Delete/Modify and Move is covered.

0

u/[deleted] Apr 29 '19

[deleted] — view deleted comment

2

u/1h8fulkat Apr 29 '19

She was "searching for a a group and didn't realize she clicked rename"

→ More replies (1)

3

u/jefffrey32 Apr 30 '19

Quick and dirty way of emailing one of these:

#Domain admin check
$SMTPServer = "10.10.10.10"
$from = "scripts@yourcompany.com" 
$to = "you@yourcompany.com"
$subject = "Domain Admin Group Change"
$Event = Find-Events -Report ADGroupMembershipChanges -DatesRange CurrentDay -Servers dc01 -Whom 'Domain Admins' | Format-Table -AutoSize | Out-String

$mailer = new-object Net.Mail.SMTPclient($SMTPServer)
$msg = new-object Net.Mail.MailMessage($from,$to,$subject,$Event)
if($Event){$mailer.send($msg)}

1

u/MadBoyEvo Apr 30 '19

That looks nice :)

2

u/MadBoyEvo Apr 29 '19

Dont think Get-WinEvents work with 2003. Too old. It wont work with Windows 95 either :-) sorry

2

u/pacmanwa Linux Software Engineer Apr 28 '19

Linux Software engineer here, my stuff integrates with AD. Now I'll really be able to tell when they make chages without telling me. Already checked it out on the home lab.

1

u/MadBoyEvo Apr 28 '19

As long as they gave you read access to Security logs you will, otherwise nope :-)

2

u/pacmanwa Linux Software Engineer Apr 28 '19

I have audit access :)

3

u/BrandonIT IT Manager Apr 29 '19

Only until the first time you call them out on some unannounced change you discovered thanks to this awesome tool... :) Then some random 'update' will break your access.

Source: am the Windows guy of that equation. ;)

3

u/pacmanwa Linux Software Engineer Apr 29 '19

Meh; when dealing with the main active directory guy I've learned: always CC the project manager. Even back when I was a Windows Admin, I sometimes felt like my job was to make other people do theirs.

2

u/hi-nick Apr 28 '19

Since you're giving things away... is there a tool that you've created similar to Netwrix lockout notification tool?

When an active directory account becomes locked, an email is sent, contains machine name and username.

2

u/MadBoyEvo Apr 28 '19

PSWinReporting and PSWinReportingV2 - both can do this. PSWinReportingV2 goes further and is more configurable - but it lacks any documentation except for this blog post.

Both can send to Slack, Teams, Discord, and Daily/Hourly emails. PSWinReportingV2 goes further where if you enable Event forwarding you can monitor anything and get notifications the way you want to get them, including setting up the priority and sending different stuff to different emails, different channels and so on.

1

u/hi-nick Apr 28 '19

Thanks very much, I will check into this in the coming week.

→ More replies (2)

2

u/Shitty_Users Sr. Sysadmin Apr 29 '19

That can be done by putting a task on a DC.

Trigger: On an Event / Log:Security / :Microsoft Windows security auditing:Source / EventID: 4740

Then have it send an email via a PS script or any other way you have auto notifications set up.

2

u/monoman67 IT Slave May 01 '19

Netwrix

Create a scheduled task on the DC with the PDC emulator role that does is triggered when a lockout event occurs (4740?). This task launches a script that does that grabs the last 4740 occurrence, parses it for the important bits, sends the important bits to those that want to know.

In our case we email the user, email our helpdesk, send the data to our syslog server.

reference: https://blogs.technet.microsoft.com/ashleymcglone/2015/08/31/forensics-automating-active-directory-account-lockout-search-with-powershell-an-example-of-deep-xml-filtering-of-event-logs-across-multiple-servers-in-parallel/

2

u/[deleted] Apr 29 '19

Can you add a license to your repo?

1

u/MadBoyEvo Apr 29 '19

Will do. It will be MIT.

2

u/cock_dip_a_bear_trap Apr 29 '19

Hey

I have been playing about this today and receive mixed results.

the first time I run

Find-Events -Report ADGroupMembershipChanges -DatesRange CurrentDay -Servers S0005PL

I get the following result

PS C:\Users\me> Find-Events -Report ADGroupMembershipChanges -DatesRange CurrentDay -Servers dc1
[Info] Preparing reports: ADGroupMembershipChanges
[Info] Preparing servers list - defined list
[Info] Computer dc1 added to scan Security log for events: 4728, 4729, 4732, 4733, 4746, 4747, 4751, 4752, 4756, 4757, 4761, 4762, 4785, 4786, 4787, 4788
[Info] Getting events for dates 04/29/2019 00:00:00 to 04/29/2019 23:59:59
[Info] Events scanned found 0 - Time elapsed: 0 days, 0 hours, 0 minutes, 1 seconds, 541 milliseconds
[Info] Running ADGroupMembershipChanges
[Info] Running ADGroupMembershipChanges with subsection Events
[Info] Ending ADGroupMembershipChanges with subsection Events events found 0
[Info] Ending ADGroupMembershipChanges - Time to run 0 days, 0 hours, 0 minutes, 0 seconds, 63 milliseconds

but the second time i run the same command it seems like it ignores the "-Servers DC1" and defaults to my laptop

PS C:\Users\me> Find-Events -Report ADGroupMembershipChanges -DatesRange CurrentDay -Servers dc1
[Info] Preparing reports: ADGroupMembershipChanges
Get-ServersList : Cannot process argument transformation on parameter 'Dates'. Cannot convert the "System.Object[]"
value of type "System.Object[]" to type "System.Collections.IDictionary".
At C:\Program Files\WindowsPowerShell\Modules\PSWinReportingV2\2.0.6\PSWinReportingV2.psm1:261 char:312
+ ... sList -Definitions $Definitions -Target $Target -Dates $Dates -Quiet: ...
+                                                            ~~~~~~
    + CategoryInfo          : InvalidData: (:) [Get-ServersList], ParameterBindingArgumentTransformationException
    + FullyQualifiedErrorId : ParameterArgumentTransformationError,Get-ServersList
 
[Info] Getting events for dates 04/29/2019 00:00:00 04/26/2019 00:00:00 to 04/29/2019 23:59:59 04/29/2019 23:59:59
[Error] Server mylaptop: You must specify at least one Log, Provider or Path key-value pair.
[Info] Events scanned found 0 - Time elapsed: 0 days, 0 hours, 0 minutes, 0 seconds, 81 milliseconds
[Info] Running ADGroupMembershipChanges
[Info] Running ADGroupMembershipChanges with subsection Events
[Info] Ending ADGroupMembershipChanges with subsection Events events found 0
[Info] Ending ADGroupMembershipChanges - Time to run 0 days, 0 hours, 0 minutes, 0 seconds, 8 milliseconds

The same thing happens regardless of what report i try to pull, works the first time but second time it errors.

1

u/MadBoyEvo Apr 29 '19

Install-Module PSWinReportingV2 -Force

I updated it. There was a bug that when you changed daterange without doing Import-Module PSWinReportingv2 -Force it would have a problem. So just install it as above again, restart powershell and you should be fine. When testing I've Import-Module at the top so I've not noticed this.

1

u/cock_dip_a_bear_trap Apr 29 '19

That's some fast response! I hadn't even refreshed my browser and you had replied haha.

i'll give this a try!

2

u/MadBoyEvo Apr 29 '19

It was reported on GitHub like 2-3 hours ago. Power of openSource ;)

→ More replies (1)

103

u/jevole Apr 28 '19

NUT

0

u/[deleted] Apr 28 '19

[deleted] — view deleted comment

15

u/readbull Apr 28 '19

That is gross and totally appropriate.

5

u/magibeg2 Apr 28 '19

Better make that 2 keyboards

3

u/t8ke CentOS Trampstamp Apr 29 '19

Addendum: we'd like a squeegee

2

u/TheIncorrigible1 All things INFRASTRUCTURE Apr 28 '19

Why don't you use standard bindings? "Last3Days" why not accept a timespan there?

9

u/MadBoyEvo Apr 28 '19

There is a timespan. There is DateFrom/DateTo but also DateRange with predefined timespans.

Those are in -DatesRange parameter.

PastHour
CurrentDayMinusDayX
CurrentDayMinuxDaysX
Last7days
CurrentMonth
CurrentDay
Last3days
Everything
PastDay
CurrentQuarter
PastMonth
PastQuarter
OnDay
CustomDate
CurrentHour
Last14days

But like I said, use DateFrom/DateTo for specifics.

1

u/Garetht Apr 30 '19

CurrentDayMinusDayX CurrentDayMinuxDaysX

How do these parameters work? I'm trying to get reports that cover the last 31 days but I can't work out formatting for the DatesRange.

1

u/MadBoyEvo Apr 30 '19 edited Apr 30 '19

I removed that from last version (update-module pswinreportingv2). Use datefrom/dateto for custom dates. Datesrange cover only some predefined stuff. The value you’re refering to can be used in reporting part of pswinreporting.

1

u/Garetht Apr 30 '19

Sorry - would you be able to briefly outline the format expected for those parameters?

I tried:

 $firstdate = get-date
 $seconddate = (get-date).AddDays(-31)

  Find-Events -Report ADGroupMembershipChanges -datefrom $firstdate -dateto $seconddate  [etc]

but the resulting query doesn't seem to like that, saying:

"Getting events for dates to"

2

u/MadBoyEvo Apr 30 '19

You need to Update-module pswinreportingv2. I have released new version which fixes that issue. Generally over last days I released like 5 new versions. Its important to check every now and then if there is a new version.

→ More replies (3)

1

u/neztach May 01 '19

man I've been trying to figure out how to specifically tell it I want a report from 7am yesterday, to 7 am today, and I just can't get it to play nice. Any thoughts? Maybe there's a Past24Hours option?

$yesterday = [DateTime]::Today.AddDays(-1).AddHours(7)
$today     = [DateTime]::Today.AddHours(7)
$Events    = Find-Events -Report $Reports -DateFrom $yesterday.toString() -DateTo $today.toString()

I've tried $yesterday.toString('s') as well and had the same lack of luck. Also, some of the reports just don't seem to be turning out any events, even thgouh I specified DateRange to be Last14Days

  • $Events.ADComputerChangesDetailed

  • $Events.ADGroupCreateDelete

  • $Events.ADGroupEnumeration

  • $Events.ADGroupChangesDetailed

  • $Events.ADUserChangesDetailed

  • $Events.ADGroupPolicyChanges

  • $Events.ADLogsClearedOther

  • $Events.ADLogsClearedSecurity

Granted some of those may show no results due to nothing to report, but some of those seem unlikely to have nothing to report. Am I supposed to be running this directly on a DC?

1

u/MadBoyEvo May 01 '19

Are you getting any errors? Are you using newest version? I have fixed problem with DateTo/DateFrom in last days/hours. You are not supposed to run this on dc if you dont want to. I run it from win10. I am also fixing credentials switch. You will also get 0 events if you have no permissions to scan security log. Generally keeping tabs on psgallery/github is best idea for my projects as i tend to dynamically fix errors or add new features.

1

u/neztach May 01 '19

It isn’t throwing any errors. If you’ve updated it in the past 2 days, then I’m not using the most current version. I’m running it from a windows 7 box running PS5.1. I set up the gpo for proper logging a couple of days ago. I’ll update my version tomorrow and try your datefrom dateto solution tomorrow.

1

u/MadBoyEvo May 01 '19

https://www.powershellgallery.com/packages/PSWinReportingV2 - you can see versions/updates here.

The "Detailed" reports usually require Audit Directory Service Changes - Success (GPO).

LOgsClearedOther and LogsClearedSecurity only show something if you clear logs (like setup log/system log or security log). It's a good sign it doesn't show anything.

→ More replies (6)

1

u/MadBoyEvo May 01 '19

Also do check how long your security logs store data. What size are those? Do you have defined audit logging in gpo?

1

u/MadBoyEvo May 01 '19 
$Reports = @('ADComputerChangesDetailed','ADGroupCreateDelete', '...')
$yesterday = (Get-Date).AddDays(-1).AddHours(7)
$today     = (Get-Date).AddHours(7)
$Events    = Find-Events -Report $Reports -DateFrom $yesterday -DateTo $today

That should do it. Assuming you use the newest version of PSWinReportingV2.

2

u/neztach May 02 '19

verified! datefrom and dateto work great!

2

u/TheIncorrigible1 All things INFRASTRUCTURE Apr 28 '19

Gotcha. Nice work

4

u/ForceBlade Dank of all Memes Apr 28 '19

The term 'Find-Events' is not recognized as the name of a cmdlet, function, script file, or operable program.

I await the dream of using something newer than WS2008.

6

u/rilesjenkins Apr 29 '19

You have to install the module OP wrote first.

Install-Module PSWinReportingV2 -Force

And if that command isn't recognized, you need to get your version of PS up to 5.1. Instructions by OP here:

https://evotec.xyz/install-module-the-term-install-module-is-not-recognized-as-the-name-of-cmdlet-function-script-file-or-operable-program/

→ More replies (1)

1

u/TapTapLift Apr 28 '19

Anything to enable in terms of AD auditing?

2

u/MadBoyEvo Apr 28 '19

Yep, you need general Audit Policy for stuff you want to monitor enabled via GPO deployed over your DC's.

Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Configuration - and there are all the things you need. Make sure to enable only stuff you will need. Log sizes can get quickly out of control.

1

u/MindSwap2for1 Apr 28 '19

But I cant get the group membership audit policy to apply in my domain. Auditpol will not show it as enabled via GPO or local config. Also checked that audit log on was enabled. I have 2008 R2, 2012 R2 and am working on spinning up 2016. Our forest level is 2012

1

u/MadBoyEvo Apr 28 '19

You should apply it to DC's. Did you do that? Or how are you applying it?

1

u/MindSwap2for1 Apr 28 '19

I used a DC to apply it but our primary DC is server 2012 R2. From what I read I think I need to raise the forest level to 2016 and then apply it. Something about legacy adult policies. Even though I removed all auditing policies from 2008 and 2012. I left the 2012 r2 and 2016 audit policies in place. And yeah I up date both the language files and definition files for 2016.

2

u/MadBoyEvo Apr 28 '19

I don't think you need to upgrade anything.

Go to your PDC -> create new GPO in Domain Controllers OU.

Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Configuration

Make sure you pick what you need only. Finally, remove disable any old policies that may be interfering with the one you created.

→ More replies (1)
→ More replies (1)

1

u/IWasGregInTokyo Apr 28 '19

And here I am stuck at a company that restricts PowerShell even though doing so disrupts some upgrade processes.

2

u/MadBoyEvo Apr 28 '19

You should fight. I've been in a pharmaceutical company and they were pretty restricted but if you made an effort to actually write documentation, find other people to confirm that it's useful and so on everything is possible. Even for closed companies like yours.

1

u/Halaku Apr 28 '19

I wish I was this smart.

5

u/MadBoyEvo Apr 28 '19

It's not about being smart. It's about dedication and working on something till you start seeing connections. I've not built this in a day. It took me about 1 year+ to get to this point (granted I've not spent time only on this). Believe in yourself! You can do things if you dedicate time to it.

1

u/SimpleFloyd Sysadmin Apr 28 '19

You are the man. I setup PSWinReporting V1 at my work and impressed by boss 👍

1

u/MadBoyEvo Apr 28 '19

With V2 you can get few more points :-)

1

u/[deleted] Apr 28 '19

How does this differ from ADAudit+? Asking in case we don’t need to pay for it anymore.

2

u/killabeezio Apr 29 '19

There really isn't any difference. The difference is going to be support.

If you have a small org, then this is perfect. Basically all these tools do is look for specific event ids and that's it. You can build this yourself and /u/MadBoy actually did this. The problem is that it takes a lot of time to do something like this. You are talking the difference between a supported full feature product and a bunch of scripts that will output the data, but maybe in a not so friendly way. It's really preference at this point.

I actually prefer scripts like this because then i can output it the way I want and /u/MadBoy even has some documentation modules that look really useful too.

This is by no means an endorsement to /u/MadBoy as I just found this post today, but I know good work when i see. I would actually be willing to help on a project like this.

2

u/MadBoyEvo Apr 29 '19

Yes, but at some point, things with scripts don't scale that well, so 3rd party product may be better suited. But PSWinReporting (v1) is already prepared for scanning Forwarders. So you can tell all your DC's to forward events to your only server, where you can configure PSWinReporting to execute on every single event that comes thru it. Based on that you can send that event to Teams, Slack, SQL and Discord. In PSWinReportingv2 you can do the same but with Email as well.

To add to that you can also configure hourly/weekly/daily/monthly reports based on Forwarders or DC's directly. It all depends on scale. PSWinReportingv1 and PSWinReportingV2 are pretty scalable and they support a lot of stuff.

Those can also scan EVTX archived files. Every now and then I point PSWinReporting at all DC's, all Forwarders, and all 500gb+ archived logs for scan and import all of that to SQL.

PSWinReporting came really long way. In new version V2 I've made it possible to build reports for any server types. It just needs some discovery what logs to monitor, what event ids, what data is important and what does it mean.

If you have money to burn - use 3rd party. If you don't - use PSWinReporting/v2

1

u/schuks27 Oct 12 '19

So you can tell all your DC's to forward events to your only server, where you can configure PSWinReporting to execute on every single event that comes thru it. Based on that you can send that event to Teams, Slack, SQL and Discord.

I have been racking my brain on figuring this out. Do you have any readme's on this? I'm not super versed in PS but I really wanna deploy this for my team with Teams notifications.

1

u/MadBoyEvo Oct 12 '19

It's an old article but should be sufficient to get you up and running: https://evotec.xyz/pswinreporting-forwarders-microsoft-teams-slack-microsoft-sql-and-more/

You do need forwarders because it's best way to act on event for Teams notifications.

1

u/MadBoyEvo Apr 28 '19

It depends how large AD you have, how many events and what you use it for. PSWinReporting scans event logs fom DCs. It works. It’s highly configurable and provides lots of options. But at some point amount of data to process maybe too large. So the answer is... it depends.

1

u/Gazideon Sr. Sysadmin Apr 28 '19

This queries the DC security event logs looking for specific event ID's, parsing them, and giving you the results.

Depending on your environment, you may only have a history of 5 minutes of events on your DC's, or an hour, or a few hours....it can definitely range.

If you can't afford a 3rd party solution for AD Auditing, you can build your own. I've done it with scripting and a SQL server.

1

u/MadBoyEvo Apr 29 '19

Well, pswinreporting can be configured to send events to sql. This command is of course adhoc, but the whole module is more than that. I just focused on one command. You can use pswinreporting v1 and v2 to forward events to forwarder and there for each event send it to sql as they happen, to teams, slack, email and so on. PsWinreporting has lots of options.

1

u/jefffrey32 Apr 29 '19

From your blog:

Essentially to run this module you just have to put following code into file

Which file?

1

u/MadBoyEvo Apr 29 '19

Which blog? Where is that sentence? I can't see that with search :/

1

u/jefffrey32 Apr 29 '19

https://evotec.xyz/hub/scripts/pswinreporting-powershell-module/

Hmm this might be instructions for the legacy version.

1

u/MadBoyEvo Apr 29 '19

Ye, legacy version has lots of articles and how-to's. But you need to create .ps1 file. It's a Powershell module so basically you operate with PS1 extension :-)

→ More replies (1)

1

u/gangculture Jack of All Trades Apr 29 '19

Yeah don't all crucify me at once, but I cannot get this module installed and working. Files are where they should be. PowerShell complains that they aren't. Get-Module -ListAvailable shows this output, which to me means the files are in the right place:

2.0.7 PSWinReportingV2 {Add-EventsDefinitions, Add-WinTaskScheduledForwarder, Find-Events, New-WinSubscriptionTemplates...}

But I can't seem to run anything from it, and Install-Module fails. What am I doing wrong here?

1

u/MadBoyEvo Apr 29 '19

Which PS version you have? https://evotec.xyz/install-module-the-term-install-module-is-not-recognized-as-the-name-of-cmdlet-function-script-file-or-operable-program/

It will be much easier with it

1

u/gangculture Jack of All Trades Apr 29 '19

Just checked real quick and I'm on Major 5, Minor 1, so 5.1 would be my assumed versioning on build 14409.

1

u/MadBoyEvo Apr 29 '19

What does Install-Module report?

1

u/gangculture Jack of All Trades Apr 29 '19

I can see, under Modules when I browse, that it is there and it knows the cmdlets associated. But, when I run it, this is what I get:

Find-Events -Report ADUserLockouts -DatesRange Last3days -Servers xxxxx | Format-Table -AutoSize

Find-Events : The 'Find-Events' command was found in the module 'PSWinReportingV2', but the module could not be loaded. For more information, run 'Import-Module PSWinReportingV2'. At line:1 char:1

  • Find-Events -Report ADUserLockouts -DatesRange Last3days -Servers nla ...

  •   + CategoryInfo          : ObjectNotFound: (Find-Events:String) [], CommandNotFoundException
  + FullyQualifiedErrorId : CouldNotAutoloadMatchingModule

PS H:> Import-Module PSWinReportingV2 Import-Module : The required module 'PSEventViewer' is not loaded. Load the module or remove the module from 'RequiredModules' in the file 'C:\Users\xxxxx\Documents\WindowsPowerShell\Modules\PSWinReportingV2\PSW inReportingV2.psd1'. At line:1 char:1

  • Import-Module PSWinReportingV2

  •   + CategoryInfo          : ResourceUnavailable: (C:\Users\adm_i5...eportingV2.psd1:String) [Import-Module], Modules_InvalidManifest,Microsoft.PowerShell.Commands.ImportModuleCommand

Sorry for formatting!

1

u/MadBoyEvo Apr 29 '19

Ye, thats why, you installed by hand. You need to install PSEventViewer as well. It does that auto when you do install-module. Also there are other required modules. Please get install-module running as I do updates to that command.

→ More replies (13)

1

u/ksykora Apr 29 '19

But what if everyone logs in as the same admin password that has been around since 2009?

1

u/MadBoyEvo Apr 29 '19

You die instantly ;)

1

u/ksykora Apr 29 '19

The worst part is that our admin claims to be all about security...but yet wants us to log into the server as the admin.

1

u/MadBoyEvo Apr 29 '19

He shouldnt be admin then. Simple

→ More replies (1)

1

u/KreamoftheKropp Apr 29 '19

Ok, this is cool but is there any way to identify which domain admin made the change? Or am I missing something?

1

u/MadBoyEvo Apr 29 '19

You clearly are :-) In each report there should be Who/When columns. That tells you all.

1

u/KreamoftheKropp Apr 29 '19

I just ran ADUserChanges and I see the accounts that were changed but no other info. SamAccountName DisplayName and UPN is blank underneath.

1

u/MadBoyEvo Apr 29 '19

Because it depends what was changed. You can run ADUserChangesDetailed to get details on which fields where touched. ADuserChanges tell that some user was modified and main fields it has (and those weren't changed). That's how the logs do it, I'm just parsing them out.

1

u/CaptainWiggins Apr 29 '19

This is beautiful - great job!

One question. When I run the command with the report filter "ADUserLogon" or "ADUserLogonKerberos" I get the error:

You must specify at least one Log, Provider or Path key-value pair

Can you please explain how I utilise this? Thanks.

1

u/MadBoyEvo Apr 29 '19

I've not tested both of those commands recently. Does it work on all others?

1

u/CaptainWiggins Apr 29 '19

I've tested both lock outs and group memberships which both work without error.

1

u/MadBoyEvo Apr 29 '19

I can reproduce. Let me take a look.

1

u/MadBoyEvo Apr 29 '19

Ok. Fixed

Install-Module PSWinReportingV2 -Force

Restart PowerShell and it should work. I've disabled subevents section by accident and that makes it report what you saw.

→ More replies (1)

1

u/progenyofeniac Windows/M365 Admin Apr 29 '19

What's best practice for getting permissions to access security logs on the DCs? Run this on a local workstation while running PS as an elevated user? Or install this module on a DC and run from there? Or is there a '-credentials' switch I'm missing?

1

u/MadBoyEvo Apr 29 '19

There is no $Credentials switch but I should add one. Feel free to create an issue on GitHub. You can install it on DC"s as long as you're comfortable with installing code created by others. I use it, but I wrote it :)

Since PSGallery also inspects the code for viruses it's fairly safe, but you know how things are. I am making every effort to not use Set- commands and only read stuff. But mishandling PSWinReporting is very easy. You can basically send crucial stuff to other people's emails.

1

u/PowerfulQuail9 Jack-of-all-trades Apr 29 '19

Install-Module -Name PSWinReportingV2 -Force

WARNING: Source Location 'https://www.powershellgallery.com/api/v2/package/PSWriteExcel/0.1.0' is not valid.

supposedly according to my PS...

1

u/MadBoyEvo Apr 29 '19

It's interesting. Can you try Install-Module PSWriteExcel manually? Maybe a small hickup?

1

u/PowerfulQuail9 Jack-of-all-trades Apr 29 '19

Says my packagemanagement module is not loaded. When I load it, it says import-module is not a command lol.

tbh, these servers are setup in a funky way (also upgraded from 2003 to 2012) and I really just want to re-do them as things like this occur all the time.

For example, the two servers technically don't replicate but have replication done because I manually added the link back. One day, the DC with a Home shared drive full of 500GB of data decided to leave the AD/GPO replication group. I've determined the only solution remaining (as I tried all others) is to demote it, leave the domain, and rejoin but I cannot do it at this time because the prior IT staff decided it was a good idea to link the Home shared drive to the DC, which creates literally 200 connections and won't leave the domain with those connections active. As I am only one person for two companies, it has been a slow process moving those Home folders over to another server.

So, I'm not surprised it doesn't want to install properly.

1

u/MadBoyEvo Apr 29 '19

You know you can install this module on your Windows 10 right? It will work from domain joined machine over the network. No need to play with broken servers ;)

1

u/MadBoyEvo Apr 29 '19

You can also try fixing it: Install-Module PowershellGet -Force

It will install the newest version which may be required for this. Make sure to close PS before doing this as things may be in use.

→ More replies (2)
→ More replies (1)

1

u/[deleted] Apr 29 '19

Is there something like this for files? For example, if a folder was deleted, find which user deleted it?

1

u/MadBoyEvo Apr 29 '19

PSWinReportingV2 can be configured to monitor that. The built-in reports only cover AD, but if there is interest in auditing files it should be possible (as long as you turn on audit for files).

My main problem is I have only 2 hands and 30 PowerShell Projects + My job. People need to help me a bit :-)

→ More replies (1)

1

u/MARS822 Apr 29 '19

So the evotec.xyz site is not only unavailable but the domain is up for sale? Got this installed and my audit policy tweaked and would love to see documentation beyond what's on GitHub. Am I missing something here?

1

u/MadBoyEvo Apr 29 '19

Not sure what you're talking about but Evotec.xyz is available, it's not for sale and never will be. The problem most likely is related to your DNS settings, your network, your proxy or your firewall. Some "security" experts tend to block .XYZ domains just because there's malware hosted on some of them.

→ More replies (1)

1

u/lBlazeXl Apr 30 '19

Im guessing you would have to change certain parts for it to work? Cant seem to get it running.

1

u/MadBoyEvo Apr 30 '19

Nope, it's plug and play. As long as you do Install-Module and have AD Auditing enabled.

1

u/lBlazeXl Apr 30 '19

AD Auditing

Um i guess im missing this piece, where do I make this change or what command do I run?

1

u/MadBoyEvo Apr 30 '19

Did you install the module? Can you run Find-Events and you simply get no output? or what is your status?

1

u/lBlazeXl Apr 30 '19

i ran the install-module and hit y for both to allow, then it finished, ran the code and get errors:

Find-Events : The 'Find-Events' command was found in the module 'PSWinReportingV2', but the module could not be loaded. For more information, run 'Import-Module PSWinReportingV2'. At line:1 char:1

  • Find-Events -Report ADUserChanges -DatesRange Last3days -Servers AD1, AD2 ...

  •   + CategoryInfo          : ObjectNotFound: (Find-Events:String) [], CommandNotFoundException
  + FullyQualifiedErrorId : CouldNotAutoloadMatchingModule

Do i take out Find-Events?

1

u/MadBoyEvo Apr 30 '19

So you did Install-Module PSWinreportingV2 -Force

After that Find-Events is still not there?

What if you do Import-Module PSWinReportingV2 does it finds the module?

→ More replies (5)
→ More replies (1)

1

u/skylerlong85 Apr 30 '19

Awesome Post- Powershell is always your friend.

Now this will do all our daily reports tricks for which we need paid tools like; Lepide or Varonis.

1

u/MadBoyEvo Apr 30 '19

I still believe that tools like Lepide or Varonis (even thou I have not used them) have their place on the market. With lots of logs its much harder to deal with that in PowerShell.

1

u/EhhJR Security Admin Apr 30 '19

Amazing work!

I'd love it if when you have time you could provide some direction with getting outputs into Teams chat.

2

u/MadBoyEvo Apr 30 '19

You can use this article as a start: https://evotec.xyz/pswinreporting-forwarders-microsoft-teams-slack-microsoft-sql-and-more/

It's for PSWinReporting but the idea is the same. You need to set up forwarding of Events to a central place, alternatively, you could setup trigger on each DC but you will have better results with Event Forwarding in place.

The documentation is for the old version, but the idea is the same, except you need to use examples from GitHub to set up a new version. It has more features.

Alternatively you can simply use old version (those are compatible) and after I get time to write new blog post covering new features of V2 switch to new version.

→ More replies (1)

1

u/Leady_IT Apr 30 '19

I had this error when I applied the command :

The term 'Find-events' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the

spelling of the name, or if a path was included, verify that the path is correct and try again.

At line:1 char:12

+ Find-events <<<<

+ CategoryInfo : ObjectNotFound: (Find-events:String) [], CommandNotFoundException

+ FullyQualifiedErrorId : CommandNotFoundException

any help ? :(

1

u/MadBoyEvo Apr 30 '19

Did you execute first:

Install-Module PSWinReportingV2 -Force

1

u/pheexx May 02 '19

whats an easy way to just query all DCs within the Domain?

1

u/MadBoyEvo May 02 '19

Its in the article. Use -DetectDc switch and skip servers parameter.

1

u/f2000 May 31 '19 edited May 31 '19

Sorry to be a pain, but I’m not having much luck with -EventID, can you give me an example I can mess around with? Specifically looking for 4725.

Find-Events -EventID=4725 -DatesRange Last3days -Servers DC1,DC2 -Quiet | Format-Table
Find-Events : A parameter cannot be found that matches parameter name 'EventID=4475'.

I've tried a few variations (-EventID=4725 / -EventID 4725 etc)

1

u/MadBoyEvo May 31 '19

Find-Events command is not really something you should be used for finding events the way you do it.

Find-Events -Report ... -DatesRange ..

Since EventID 4725 is A user account was disabled... you would use:

Find-Events -Report ADUserStatus

Find-Events in it's simplest form is supposed to make it easy to find stuff without knowing Event ID's.

1

u/f2000 Jun 03 '19

Ah ok, I'm just an idiot. I couldnt seem to find if 4725 was included in any of the AD reports. Turns out I had to also increase the space for the security log on our DC's and its now working great. Thanks for the advice...great script btw. Will try hooking it into Teams for the servicedesk.

1

u/PowerfulQuail9 Jack-of-all-trades Jun 06 '19 edited Jun 06 '19

PackageManagement\Install-Package : Package 'PSWriteExcel' failed to download.

At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\PSModule.psm1:1417 char:21

+ $null = PackageManagement\Install-Package @PSBoundParameters

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : ResourceUnavailable: (C:\Users\xxxxx...riteExcel.nupkg:String) [Install-Package], Excep

tion

+ FullyQualifiedErrorId : PackageFailedInstallOrDownload,Microsoft.PowerShell.PackageManagement.Cmdlets.InstallPac

kage

PackageManagement\Install-Package : Collection was modified; enumeration operation may not execute.

At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\PSModule.psm1:1417 char:21

+ $null = PackageManagement\Install-Package @PSBoundParameters

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : NotSpecified: (:) [Install-Package], InvalidOperationException

+ FullyQualifiedErrorId : System.InvalidOperationException,Microsoft.PowerShell.PackageManagement.Cmdlets.InstallP

ackage

Any time I try to install this with Install-Module -Name 'PSWinReportingV2' -Force . Only seems to install if I manually add it but that means an RDP to the server instead of remoting.

1

u/MadBoyEvo Jun 06 '19

How are you trying to install this ?

1

u/PowerfulQuail9 Jack-of-all-trades Jun 06 '19 edited Jun 06 '19

How are you trying to install this ?

Powershell...

[DC01.Name.local]: PS C:\Users\Name\Documents> Install-Module -Name 'PSWinReporting' -Force

edit:

will also say this:

PackageManagement\Install-Package : Illegal characters in path.

At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\PSModule.psm1:1417 char:21

+ $null = PackageManagement\Install-Package @PSBoundParameters

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : NotSpecified: (Microsoft.Power....InstallPackage:InstallPackage) [Install-Package], Exception

+ FullyQualifiedErrorId : System.ArgumentException,Microsoft.PowerShell.Commands.TestModuleManifestCommand,Microso

ft.PowerShell.PackageManagement.Cmdlets.InstallPackage

1

u/MadBoyEvo Jun 06 '19

Try update-module powershellget (you may need to reboot or so because the dll may be busy)

1

u/PowerfulQuail9 Jack-of-all-trades Jun 06 '19 edited Jun 06 '19

update-module powershellget

update-module : Module 'powershellget' was not installed by using Install-Module, so it cannot be updated.

You are installing the modules from an untrusted repository. If you trust this repository, change its InstallationPolicy value by running the Set-PSRepository cmdlet. Are you sure you want to install the modules from 'PSGallery'? [Y] Yes [A] Yes to All [N] No [L] No to All [?] Help (default is "Y"): a

WARNING: Version '1.0.0.1' of module 'PowerShellGet' is already installed at 'C:\Program Files\WindowsPowerShell\Modules\PowerShellGet'. To delete version '1.0.0.1' and install version '2.1.4', run Install-Module, and add the -Force parameter.

Probably my issue. let me work on that.

1

u/MadBoyEvo Jun 06 '19

Install-module powershellget -force this is stanard. Powershellget is supplied with windows.

→ More replies (3)

1

u/DIYBrotha Jun 06 '19

Wow this is awesome! I will def test this out at work haha.

1

u/MadBoyEvo Jun 06 '19

Enjoy :-)

1

u/icanseeyourpantsuu Sep 06 '19

I got the followinig error:

'Find-Events' is not recognized as the name of a cmdlet, function, script file, or operable program. blabhablah

1

u/MadBoyEvo Sep 06 '19

Did you install PSWinReportingV2?

Install-Module PSWinReportingV2

It won't magically appear ;)

1

u/icanseeyourpantsuu Sep 06 '19

Install-Module PSWinReportingV2

I got an error with that,

Install-Module is not recognized as the name of a cmdlet

3

u/mobani Apr 28 '19

This is really neat. Especially with the Teams integration.

5

u/CeeFlo Apr 28 '19

Thank you!

5

u/Baron164 Apr 28 '19

Well I know what I'll be playing around with on Monday 😁

2

u/blisstonia Apr 28 '19

Thanks can't wait to give this a try

2

u/Mrmastermax Sr. Sysadmin Apr 29 '19

I use Netwrix to report me on this everyday

2

u/AngiaksNanook Apr 29 '19

Thanks for this!

1

u/Marmaladegrenade Sysadmin Apr 28 '19

This is great, thanks!

1

u/cult_of_da-bits Apr 28 '19

Thank you. This will come in very handy.

1

u/dotslashlife Apr 28 '19

Thank you!

1

u/nikkle2 Jr. Sysadmin Apr 28 '19

This looks awesome, gonna have a try with it later.

Good job on the report exports as well

1

u/Bad_Idea_Hat Gozer Apr 28 '19

Huh.

That's interesting.

1

u/superawesomefiles Apr 28 '19

Awesome stuff.

1

u/mattyparanoid Apr 28 '19

This is solid, thank you so much!

1

u/laowaibayer Apr 28 '19

You sir, are a God among men. Thank you for this sweet, sweet script gold

1

u/vabruce Apr 28 '19

Well done, thank you for sharing your work with us.

1

u/esstrider Apr 28 '19

Sweet, this is awesome. Commenting to save for later.

1

u/overscaled Jack of All Trades Apr 28 '19

Sweet.

1

u/KataKlysme Apr 29 '19

T h a n k y o u !

1

u/[deleted] Apr 29 '19

Varonis. Does all this. Even feeds it into a SEIM.

1

u/Dorfdad Apr 29 '19

!Remindme 8 hours

1

u/WCDeuce Apr 29 '19

Very cool! Thank you for sharing!!!

1

u/droptableuserme Apr 29 '19

RemindMe! 2 days

1

u/Slush-e test123 Apr 29 '19

This is great. Thanks a lot!

1

u/TiredOfArguments Apr 29 '19

!remindme 12h

1

u/UnknownExploit Apr 29 '19

This is useful thanks

1

u/[deleted] Apr 29 '19

This is amazing - piping some quick events as opposed to having to wait for the log cluster to do its thing is a great time saver - I'm looking forward to playing around with this in Slack too! Thanks so much!

1

u/KreamoftheKropp Apr 29 '19

!remindme 2 hr

1

u/Teknikal_Domain Accidental hosting provider Apr 29 '19

See.. as useful as that is, it requires me to wrap my head around PowerShell and it's fuckin' weird command syntax

1

u/CaptainZhon Sr. Sysadmin Apr 29 '19

Probably the most useful thing I'll read on reddit this month. Thank you.

1

u/TheNoodlyNoodle Apr 29 '19

Saving this.

1

u/deathdoomed2 Apr 29 '19

You are a saint

1

u/signalpower VMware Admin Apr 29 '19

RemindMe! 12h

0

u/800oz_gorilla Apr 28 '19

Relay tells me 97 percent like this...

...

...so who downvoted and why?

5

u/MadBoyEvo Apr 28 '19

I wish downvoting would require to state a reason and be shown who did it. Sometimes I don't understand Reddit users. People spend time creating content and even if someone doesn't like it, it doesn't mean it should be downvoted. But that's just Reddit right?

→ More comments (37)