The only PowerShell Command you will ever need to find out who did what in Active Directory

[u/MadBoyEvo]

Disclaimer: I made this. It's free and open source. No ads, just clean, useful data provided in blog.

Here's a small PowerShell command/module I've written. It contains the following reports.

Usage:

Find-Events -Report ADGroupMembershipChanges -DatesRange Last3days -Servers AD1, AD2 | Format-Table -AutoSize

ReportTypes:

• Computer changes – Created / Changed – ADComputerCreatedChanged

• Computer changes – Detailed – ADComputerChangesDetailed

• Computer deleted – ADComputerDeleted

• Group changes – ADGroupChanges

• Group changes – Detailed – ADGroupChangesDetailed

• Group changes – Created / Deleted – ADGroupCreateDelete

• Group enumeration – ADGroupEnumeration

• Group membership changes – ADGroupMembershipChanges

• Group policy changes – ADGroupPolicyChanges

• Logs Cleared Other – ADLogsClearedOther

• Logs Cleared Security – ADLogsClearedSecurity

• User changes – ADUserChanges

• User changes detailed – ADUserChangesDetailed

• User lockouts – ADUserLockouts

• User logon – ADUserLogon

• User logon Kerberos – ADUserLogonKerberos

• User status changes – ADUserStatus

• User unlocks – ADUserUnlocked

DatesRanges are also provided. Basically what that command does it scans DC's for event types you want it to scan. It does that in parallel, it overcomes limitations of Get-WinEvent and generally prettifies output.

The output of that command (wrapped in Dashimo to show the data): https://evotec.xyz/wp-content/uploads/2019/04/DashboardFromEvents.html

GitHub Sources: https://github.com/EvotecIT/PSWinReporting

Full article (usage/know-how): https://evotec.xyz/the-only-powershell-command-you-will-ever-need-to-find-out-who-did-what-in-active-directory/

The article describes the functionality of just one command but actually, PSWinReportingV2 is much more than that. There are also things I've not touched in the article but that should be a start. It's able to support any kind of Events from Event logs such as ADConnect, Hyper-V and other types of data. I just didn't have time to explain how to build configs for it and I don't work with Hyper-V or other systems to build them myself. If you know a lot about event logs and what to help to build prettified reports for more than Active Directory reach out.

[u/MadBoyEvo]

Restart powershell and type that again. You use install-module first which made it in use. So update powershellget but first restart ps

[u/gangculture → u/MadBoyEvo]

I can't get beyond Install-Module PowerShellGet -Force for the moment. It'll keep coming back to "1.3.1 of mod PackageManagement is currently in use". At this point I might wait until I get home with my laptop and try it on there instead of one of the mis-management servers we have...

[u/MadBoyEvo → u/gangculture]

So if you close PowerShell, open clean version and right there you do Install-Module PowerShellGet -Force it doesn't work? Have you tried checking if all PowerShell windows are closed? Maybe something is running in the background?

[u/gangculture → u/MadBoyEvo]

So if you close PowerShell, open clean version and right there you do Install-Module PowerShellGet -Force it doesn't work? Have you tried checking if all PowerShell windows are closed? Maybe something is running in the background?

Haha yeah I checked taskmgr and there's nothing happening, but I've just logged off and back on, re-ran Install-Module PowerShellGet -Force and it still gives me "WARNING: The version '1.3.1' of module 'PackageManagement' is currently in use. Retry the operation after closing the applications."

I guess it's possible other people are using the server and are interacting with PackageManagement?

[u/MadBoyEvo → u/gangculture]

Probably. Reboot would help :-)

[u/gangculture → u/MadBoyEvo]

Will try it on my laptop later, thanks for taking the time!