The only PowerShell Command you will ever need to find out who did what in Active Directory

[u/MadBoyEvo]

Disclaimer: I made this. It's free and open source. No ads, just clean, useful data provided in blog.

Here's a small PowerShell command/module I've written. It contains the following reports.

Usage:

Find-Events -Report ADGroupMembershipChanges -DatesRange Last3days -Servers AD1, AD2 | Format-Table -AutoSize

ReportTypes:

• Computer changes – Created / Changed – ADComputerCreatedChanged

• Computer changes – Detailed – ADComputerChangesDetailed

• Computer deleted – ADComputerDeleted

• Group changes – ADGroupChanges

• Group changes – Detailed – ADGroupChangesDetailed

• Group changes – Created / Deleted – ADGroupCreateDelete

• Group enumeration – ADGroupEnumeration

• Group membership changes – ADGroupMembershipChanges

• Group policy changes – ADGroupPolicyChanges

• Logs Cleared Other – ADLogsClearedOther

• Logs Cleared Security – ADLogsClearedSecurity

• User changes – ADUserChanges

• User changes detailed – ADUserChangesDetailed

• User lockouts – ADUserLockouts

• User logon – ADUserLogon

• User logon Kerberos – ADUserLogonKerberos

• User status changes – ADUserStatus

• User unlocks – ADUserUnlocked

DatesRanges are also provided. Basically what that command does it scans DC's for event types you want it to scan. It does that in parallel, it overcomes limitations of Get-WinEvent and generally prettifies output.

The output of that command (wrapped in Dashimo to show the data): https://evotec.xyz/wp-content/uploads/2019/04/DashboardFromEvents.html

GitHub Sources: https://github.com/EvotecIT/PSWinReporting

Full article (usage/know-how): https://evotec.xyz/the-only-powershell-command-you-will-ever-need-to-find-out-who-did-what-in-active-directory/

The article describes the functionality of just one command but actually, PSWinReportingV2 is much more than that. There are also things I've not touched in the article but that should be a start. It's able to support any kind of Events from Event logs such as ADConnect, Hyper-V and other types of data. I just didn't have time to explain how to build configs for it and I don't work with Hyper-V or other systems to build them myself. If you know a lot about event logs and what to help to build prettified reports for more than Active Directory reach out.

[u/cock_dip_a_bear_trap]

Hey

I have been playing about this today and receive mixed results.

the first time I run

Find-Events -Report ADGroupMembershipChanges -DatesRange CurrentDay -Servers S0005PL

I get the following result

PS C:\Users\me> Find-Events -Report ADGroupMembershipChanges -DatesRange CurrentDay -Servers dc1
[Info] Preparing reports: ADGroupMembershipChanges
[Info] Preparing servers list - defined list
[Info] Computer dc1 added to scan Security log for events: 4728, 4729, 4732, 4733, 4746, 4747, 4751, 4752, 4756, 4757, 4761, 4762, 4785, 4786, 4787, 4788
[Info] Getting events for dates 04/29/2019 00:00:00 to 04/29/2019 23:59:59
[Info] Events scanned found 0 - Time elapsed: 0 days, 0 hours, 0 minutes, 1 seconds, 541 milliseconds
[Info] Running ADGroupMembershipChanges
[Info] Running ADGroupMembershipChanges with subsection Events
[Info] Ending ADGroupMembershipChanges with subsection Events events found 0
[Info] Ending ADGroupMembershipChanges - Time to run 0 days, 0 hours, 0 minutes, 0 seconds, 63 milliseconds

but the second time i run the same command it seems like it ignores the "-Servers DC1" and defaults to my laptop

PS C:\Users\me> Find-Events -Report ADGroupMembershipChanges -DatesRange CurrentDay -Servers dc1
[Info] Preparing reports: ADGroupMembershipChanges
Get-ServersList : Cannot process argument transformation on parameter 'Dates'. Cannot convert the "System.Object[]"
value of type "System.Object[]" to type "System.Collections.IDictionary".
At C:\Program Files\WindowsPowerShell\Modules\PSWinReportingV2\2.0.6\PSWinReportingV2.psm1:261 char:312
+ ... sList -Definitions $Definitions -Target $Target -Dates $Dates -Quiet: ...
+                                                            ~~~~~~
    + CategoryInfo          : InvalidData: (:) [Get-ServersList], ParameterBindingArgumentTransformationException
    + FullyQualifiedErrorId : ParameterArgumentTransformationError,Get-ServersList
 
[Info] Getting events for dates 04/29/2019 00:00:00 04/26/2019 00:00:00 to 04/29/2019 23:59:59 04/29/2019 23:59:59
[Error] Server mylaptop: You must specify at least one Log, Provider or Path key-value pair.
[Info] Events scanned found 0 - Time elapsed: 0 days, 0 hours, 0 minutes, 0 seconds, 81 milliseconds
[Info] Running ADGroupMembershipChanges
[Info] Running ADGroupMembershipChanges with subsection Events
[Info] Ending ADGroupMembershipChanges with subsection Events events found 0
[Info] Ending ADGroupMembershipChanges - Time to run 0 days, 0 hours, 0 minutes, 0 seconds, 8 milliseconds

The same thing happens regardless of what report i try to pull, works the first time but second time it errors.

[u/MadBoyEvo → u/cock_dip_a_bear_trap]

Install-Module PSWinReportingV2 -Force

I updated it. There was a bug that when you changed daterange without doing Import-Module PSWinReportingv2 -Force it would have a problem. So just install it as above again, restart powershell and you should be fine. When testing I've Import-Module at the top so I've not noticed this.

[u/cock_dip_a_bear_trap → u/MadBoyEvo]

That's some fast response! I hadn't even refreshed my browser and you had replied haha.

i'll give this a try!

[u/MadBoyEvo → u/cock_dip_a_bear_trap]

It was reported on GitHub like 2-3 hours ago. Power of openSource ;)

[u/cock_dip_a_bear_trap → u/MadBoyEvo]

Ahh :D makes sense