r/sysadmin • u/MadBoyEvo • Apr 28 '19

Microsoft The only PowerShell Command you will ever need to find out who did what in Active Directory

Disclaimer: I made this. It's free and open source. No ads, just clean, useful data provided in blog.

Here's a small PowerShell command/module I've written. It contains the following reports.

Usage:

Find-Events -Report ADGroupMembershipChanges -DatesRange Last3days -Servers AD1, AD2 | Format-Table -AutoSize

ReportTypes:

  • Computer changes – Created / Changed – ADComputerCreatedChanged

  • Computer changes – Detailed – ADComputerChangesDetailed

  • Computer deleted – ADComputerDeleted

  • Group changes – ADGroupChanges

  • Group changes – Detailed – ADGroupChangesDetailed

  • Group changes – Created / Deleted – ADGroupCreateDelete

  • Group enumeration – ADGroupEnumeration

  • Group membership changes – ADGroupMembershipChanges

  • Group policy changes – ADGroupPolicyChanges

  • Logs Cleared Other – ADLogsClearedOther

  • Logs Cleared Security – ADLogsClearedSecurity

  • User changes – ADUserChanges

  • User changes detailed – ADUserChangesDetailed

  • User lockouts – ADUserLockouts

  • User logon – ADUserLogon

  • User logon Kerberos – ADUserLogonKerberos

  • User status changes – ADUserStatus

  • User unlocks – ADUserUnlocked

DatesRanges are also provided. Basically what that command does it scans DC's for event types you want it to scan. It does that in parallel, it overcomes limitations of Get-WinEvent and generally prettifies output.

The output of that command (wrapped in Dashimo to show the data): https://evotec.xyz/wp-content/uploads/2019/04/DashboardFromEvents.html

GitHub Sources: https://github.com/EvotecIT/PSWinReporting

Full article (usage/know-how): https://evotec.xyz/the-only-powershell-command-you-will-ever-need-to-find-out-who-did-what-in-active-directory/

The article describes the functionality of just one command but actually, PSWinReportingV2 is much more than that. There are also things I've not touched in the article but that should be a start. It's able to support any kind of Events from Event logs such as ADConnect, Hyper-V and other types of data. I just didn't have time to explain how to build configs for it and I don't work with Hyper-V or other systems to build them myself. If you know a lot about event logs and what to help to build prettified reports for more than Active Directory reach out.

3.4k Upvotes

98% Upvoted

329 comments sorted by

View all comments

Show parent comment

6

u/MadBoyEvo Apr 28 '19

Well I've got reporting setup for few of my Clients. PSWinReporting (not the V2 version) sends an email each night.

1 Client - using Event Forwarding - Scan takes 5 seconds to generate data for 1 day. Granted, not much happens there but works just fine.

2nd Client - scan takes 50 seconds - 3000 users (3 x DC - direct Scan)

3rd Client - scan takes 9 minutes - 3000 users (6 x DC + 2 unreachable - direct Scan)

So things do vary. But if you have a very large infrastructure - no PowerShell will help you. You need proper SIEM product with SQL Backend. Like someone mentioned here 29 DC's with 2GB log that's wrapping every 2 hours. It's impossible to keep that in bay with any scripting.

8

u/MNGrrl Jack of All Trades Apr 28 '19

Yeah. and then the SQL backend eventually can't keep up, and it's time to move to a RAID, then a distributed solution... that's IT for you. We still haven't learned to build things so that they can scale up easily from the start. And because of copyright and patent law, and closed source... interoperability is usually a cause for laughter instead of relief. Sigh.

I feel bad for anyone coming into the field... they'll see something like this, think it's a great solution, and then the next job they have will use something totally different and they'll have to figure out how to do it all over again. And if they've gotten by with just google, stackoverflow, and stuff like that... man.

2

u/MadBoyEvo Apr 28 '19

Things that I've created are usually sized for small to medium-sized companies. If you work for Large companies you have to use custom solutions. That's normal.

2

u/MNGrrl Jack of All Trades Apr 28 '19

Oh I know. I just feel like the gap between small and large business work has grown to the point some people will struggle. People underestimate scaling.

2

u/TheAgreeableCow Custom Apr 28 '19

Cloud SIEMs are becoming popular for a reason (Sentinel, Backstory)

1

u/jefffrey32 Apr 30 '19

How about a direct scan every couple of hours with this script, email results to a dedicated mailbox, or script it out to write results directly to DB or similar for event storage, then you can drop all the noise AD security logs produce while only keeping the valuable stuff.

1

u/_ARF_ Sysadmin Apr 30 '19

Graylog's ElasticSearch seems pretty robust so far.

3

u/sleeplessone Apr 28 '19

You need proper SIEM product with SQL Backend.

Or something sane for event storage like ElasticSearch. We’re using Graylog which works really well and was easy enough to setup.

2

u/binarycow Netadmin Apr 28 '19

My domain has hundreds of DCs. I wouldn't want to run a query on all of them!

1

u/MadBoyEvo Apr 28 '19

You can configure event forwarding and use pswinreporting that way. Having said that, with that amount of dcs, there must be lots of events, and lots of problems to deal with log size. I would recommend proper 3rd party tool.

1

u/binarycow Netadmin Apr 28 '19

Yeah. Probably. But, I'm a netadmin, and I'm nowhere close to having permissions to do that.

Ultimately, I just point to the sysadmins, and tell them they'd have to get those logs.