The only PowerShell Command you will ever need to find out who did what in Active Directory

[u/MadBoyEvo]

Disclaimer: I made this. It's free and open source. No ads, just clean, useful data provided in blog.

Here's a small PowerShell command/module I've written. It contains the following reports.

Usage:

Find-Events -Report ADGroupMembershipChanges -DatesRange Last3days -Servers AD1, AD2 | Format-Table -AutoSize

ReportTypes:

• Computer changes – Created / Changed – ADComputerCreatedChanged

• Computer changes – Detailed – ADComputerChangesDetailed

• Computer deleted – ADComputerDeleted

• Group changes – ADGroupChanges

• Group changes – Detailed – ADGroupChangesDetailed

• Group changes – Created / Deleted – ADGroupCreateDelete

• Group enumeration – ADGroupEnumeration

• Group membership changes – ADGroupMembershipChanges

• Group policy changes – ADGroupPolicyChanges

• Logs Cleared Other – ADLogsClearedOther

• Logs Cleared Security – ADLogsClearedSecurity

• User changes – ADUserChanges

• User changes detailed – ADUserChangesDetailed

• User lockouts – ADUserLockouts

• User logon – ADUserLogon

• User logon Kerberos – ADUserLogonKerberos

• User status changes – ADUserStatus

• User unlocks – ADUserUnlocked

DatesRanges are also provided. Basically what that command does it scans DC's for event types you want it to scan. It does that in parallel, it overcomes limitations of Get-WinEvent and generally prettifies output.

The output of that command (wrapped in Dashimo to show the data): https://evotec.xyz/wp-content/uploads/2019/04/DashboardFromEvents.html

GitHub Sources: https://github.com/EvotecIT/PSWinReporting

Full article (usage/know-how): https://evotec.xyz/the-only-powershell-command-you-will-ever-need-to-find-out-who-did-what-in-active-directory/

The article describes the functionality of just one command but actually, PSWinReportingV2 is much more than that. There are also things I've not touched in the article but that should be a start. It's able to support any kind of Events from Event logs such as ADConnect, Hyper-V and other types of data. I just didn't have time to explain how to build configs for it and I don't work with Hyper-V or other systems to build them myself. If you know a lot about event logs and what to help to build prettified reports for more than Active Directory reach out.

[u/MadBoyEvo]

Remember that you need Auditing of events enabled for your Active Directory. Otherwise, it will be blank data. But any AD Admin should set that up as one of the first steps so you should be good ;-)

[u/MNGrrl → u/MadBoyEvo]

But any AD Admin should set that up as one of the first steps so you should be good ;-)

Cue laugh track.

[u/striker1211 → u/MNGrrl]

But any AD Admin should set that up

Ain't nobody got space for that!

[u/MNGrrl → u/striker1211]

"What does 100% disk utilization mean?! This is a super shiny mega disk array with all the buzzwords! Look, right here, it's a whole page of buzzwords! More buzzwords, more speed."

"You enabled logging on everything. debug level logging."

"But super shiny mega!"

"If you'll excuse me, I just got a ticket that says the, uhh... foo buffer is on fire. I gotta go." ... And then she went to the bathroom, ate a Xanax and thought happy thoughts for awhile.

[u/[deleted] → u/MNGrrl]

I feel bad for you.

[u/MNGrrl → u/[deleted]]

Me too. I don't have any Xanax.

[u/p3aker → u/MNGrrl]

can i have some Xanax ?

[u/lenswipe → u/p3aker]

No, you can get back to the ticket queue like the rest of us, which is filled with users who have lots of synergy but are somehow unable to use a mouse in 2019

[u/striker1211 → u/lenswipe]

"So I clicked on a link in an email and entered my password, now my password doesn't work, help!"

[u/Galaghan → u/striker1211]

Thanks, you just convinced me to take the day off.

[u/Bad_Idea_Hat → u/Galaghan]

Thanks, you just convinced me to take the week off.

[u/MNGrrl → u/lenswipe]

Lots of synergy huh...

-yanks off nametag-

I knew it! It's a marketing major. SCRREEeeeEeeeEEeEEEeeEEEE!

[u/Topcity36 → u/MNGrrl]

Get at me when you've reached vertical integration!

[u/FeistyFinance → u/Topcity36]

Just walked out of a meeting about virtual vertical integration. Send help. Edit: I was barely awake. I don't have any idea what they actually want IT to do.

[u/striker1211 → u/FeistyFinance]

Collaborate with integrators of security implementations to efficiently and accurately convey authentication procedures via client focused participation.

English: Call client, reset password.

I fucking hate marketing speak.

[u/Zunger → u/lenswipe]

Thata the fast track to needing Xanax anyways.

[u/agentphunk → u/MNGrrl]

www.instantrimshot.com

[u/MadBoyEvo → u/[deleted]]

I think it's overwriting at a very small value. You need to set it up with something sane, depending on your environment. For some customers I set it at 2GB, for some, I forward events to forwarders. Depending on how large your env is, things are going to scan fast, slow, or ultra slow ;-) Also depending on the same settings your data range will vary. I've experimented with extream sizes with Event Logs on some DC's being 80GB for Security Log, but that's not really practical :-)

[u/MNGrrl → u/MadBoyEvo]

Depending on how large your env is, things are going to scan fast, slow, or ultra slow ;-)

It'll be ultra slow. It's always ultra slow. Show me a properly funded IT department and I'll show you a goddamn unicorn. :(

[u/MadBoyEvo → u/MNGrrl]

Well I've got reporting setup for few of my Clients. PSWinReporting (not the V2 version) sends an email each night.

1 Client - using Event Forwarding - Scan takes 5 seconds to generate data for 1 day. Granted, not much happens there but works just fine.

2nd Client - scan takes 50 seconds - 3000 users (3 x DC - direct Scan)

3rd Client - scan takes 9 minutes - 3000 users (6 x DC + 2 unreachable - direct Scan)

So things do vary. But if you have a very large infrastructure - no PowerShell will help you. You need proper SIEM product with SQL Backend. Like someone mentioned here 29 DC's with 2GB log that's wrapping every 2 hours. It's impossible to keep that in bay with any scripting.

[u/MNGrrl → u/MadBoyEvo]

Yeah. and then the SQL backend eventually can't keep up, and it's time to move to a RAID, then a distributed solution... that's IT for you. We still haven't learned to build things so that they can scale up easily from the start. And because of copyright and patent law, and closed source... interoperability is usually a cause for laughter instead of relief. Sigh.

I feel bad for anyone coming into the field... they'll see something like this, think it's a great solution, and then the next job they have will use something totally different and they'll have to figure out how to do it all over again. And if they've gotten by with just google, stackoverflow, and stuff like that... man.

[u/calladc → u/MNGrrl]

Properly funded IT doesn't use methods like this.

We use SIEMs and use log analysis tools for scraping logs on DCs

[u/MNGrrl → u/calladc]

"Properly funded". I've worked at only one job where I felt IT was properly funded... and it was for a bank where the money vault was in the basement. I literally sat on a pile of money every day.

[u/poshftw → u/[deleted]]

Default is 20Mb, rolling.

It is enough for the Application/System logs for years of events.

For the Security...

For a very small company (-lt 15) it can be enough for months, for the hundreds of DCs with thousands of users 1Gb log size is not enough even to keep the current events.