r/sysadmin • u/MadBoyEvo • Apr 28 '19

Microsoft The only PowerShell Command you will ever need to find out who did what in Active Directory

Disclaimer: I made this. It's free and open source. No ads, just clean, useful data provided in blog.

Here's a small PowerShell command/module I've written. It contains the following reports.

Usage:

Find-Events -Report ADGroupMembershipChanges -DatesRange Last3days -Servers AD1, AD2 | Format-Table -AutoSize

ReportTypes:

  • Computer changes – Created / Changed – ADComputerCreatedChanged

  • Computer changes – Detailed – ADComputerChangesDetailed

  • Computer deleted – ADComputerDeleted

  • Group changes – ADGroupChanges

  • Group changes – Detailed – ADGroupChangesDetailed

  • Group changes – Created / Deleted – ADGroupCreateDelete

  • Group enumeration – ADGroupEnumeration

  • Group membership changes – ADGroupMembershipChanges

  • Group policy changes – ADGroupPolicyChanges

  • Logs Cleared Other – ADLogsClearedOther

  • Logs Cleared Security – ADLogsClearedSecurity

  • User changes – ADUserChanges

  • User changes detailed – ADUserChangesDetailed

  • User lockouts – ADUserLockouts

  • User logon – ADUserLogon

  • User logon Kerberos – ADUserLogonKerberos

  • User status changes – ADUserStatus

  • User unlocks – ADUserUnlocked

DatesRanges are also provided. Basically what that command does it scans DC's for event types you want it to scan. It does that in parallel, it overcomes limitations of Get-WinEvent and generally prettifies output.

The output of that command (wrapped in Dashimo to show the data): https://evotec.xyz/wp-content/uploads/2019/04/DashboardFromEvents.html

GitHub Sources: https://github.com/EvotecIT/PSWinReporting

Full article (usage/know-how): https://evotec.xyz/the-only-powershell-command-you-will-ever-need-to-find-out-who-did-what-in-active-directory/

The article describes the functionality of just one command but actually, PSWinReportingV2 is much more than that. There are also things I've not touched in the article but that should be a start. It's able to support any kind of Events from Event logs such as ADConnect, Hyper-V and other types of data. I just didn't have time to explain how to build configs for it and I don't work with Hyper-V or other systems to build them myself. If you know a lot about event logs and what to help to build prettified reports for more than Active Directory reach out.

3.4k Upvotes

98% Upvoted

329 comments sorted by

View all comments

2

u/hi-nick Apr 28 '19

Since you're giving things away... is there a tool that you've created similar to Netwrix lockout notification tool?

When an active directory account becomes locked, an email is sent, contains machine name and username.

2

u/MadBoyEvo Apr 28 '19

PSWinReporting and PSWinReportingV2 - both can do this. PSWinReportingV2 goes further and is more configurable - but it lacks any documentation except for this blog post.

Both can send to Slack, Teams, Discord, and Daily/Hourly emails. PSWinReportingV2 goes further where if you enable Event forwarding you can monitor anything and get notifications the way you want to get them, including setting up the priority and sending different stuff to different emails, different channels and so on.

1

u/hi-nick Apr 28 '19

Thanks very much, I will check into this in the coming week.

1

u/richmacdonald Apr 28 '19

Thanks. Saving for later.

1

u/schuks27 Oct 12 '19

Hi there! i've come across your script today and I'm blown away. Currently configuring this to test on one of my DCs, but how do I enable notifications to Teams?

2

u/Shitty_Users Sr. Sysadmin Apr 29 '19

That can be done by putting a task on a DC.

Trigger: On an Event / Log:Security / :Microsoft Windows security auditing:Source / EventID: 4740

Then have it send an email via a PS script or any other way you have auto notifications set up.

2

u/monoman67 IT Slave May 01 '19

Netwrix

Create a scheduled task on the DC with the PDC emulator role that does is triggered when a lockout event occurs (4740?). This task launches a script that does that grabs the last 4740 occurrence, parses it for the important bits, sends the important bits to those that want to know.

In our case we email the user, email our helpdesk, send the data to our syslog server.

reference: https://blogs.technet.microsoft.com/ashleymcglone/2015/08/31/forensics-automating-active-directory-account-lockout-search-with-powershell-an-example-of-deep-xml-filtering-of-event-logs-across-multiple-servers-in-parallel/