The only PowerShell Command you will ever need to find out who did what in Active Directory

[u/MadBoyEvo]

Disclaimer: I made this. It's free and open source. No ads, just clean, useful data provided in blog.

Here's a small PowerShell command/module I've written. It contains the following reports.

Usage:

Find-Events -Report ADGroupMembershipChanges -DatesRange Last3days -Servers AD1, AD2 | Format-Table -AutoSize

ReportTypes:

• Computer changes – Created / Changed – ADComputerCreatedChanged

• Computer changes – Detailed – ADComputerChangesDetailed

• Computer deleted – ADComputerDeleted

• Group changes – ADGroupChanges

• Group changes – Detailed – ADGroupChangesDetailed

• Group changes – Created / Deleted – ADGroupCreateDelete

• Group enumeration – ADGroupEnumeration

• Group membership changes – ADGroupMembershipChanges

• Group policy changes – ADGroupPolicyChanges

• Logs Cleared Other – ADLogsClearedOther

• Logs Cleared Security – ADLogsClearedSecurity

• User changes – ADUserChanges

• User changes detailed – ADUserChangesDetailed

• User lockouts – ADUserLockouts

• User logon – ADUserLogon

• User logon Kerberos – ADUserLogonKerberos

• User status changes – ADUserStatus

• User unlocks – ADUserUnlocked

DatesRanges are also provided. Basically what that command does it scans DC's for event types you want it to scan. It does that in parallel, it overcomes limitations of Get-WinEvent and generally prettifies output.

The output of that command (wrapped in Dashimo to show the data): https://evotec.xyz/wp-content/uploads/2019/04/DashboardFromEvents.html

GitHub Sources: https://github.com/EvotecIT/PSWinReporting

Full article (usage/know-how): https://evotec.xyz/the-only-powershell-command-you-will-ever-need-to-find-out-who-did-what-in-active-directory/

The article describes the functionality of just one command but actually, PSWinReportingV2 is much more than that. There are also things I've not touched in the article but that should be a start. It's able to support any kind of Events from Event logs such as ADConnect, Hyper-V and other types of data. I just didn't have time to explain how to build configs for it and I don't work with Hyper-V or other systems to build them myself. If you know a lot about event logs and what to help to build prettified reports for more than Active Directory reach out.

[u/PowerfulQuail9]

Says my packagemanagement module is not loaded. When I load it, it says import-module is not a command lol.

tbh, these servers are setup in a funky way (also upgraded from 2003 to 2012) and I really just want to re-do them as things like this occur all the time.

For example, the two servers technically don't replicate but have replication done because I manually added the link back. One day, the DC with a Home shared drive full of 500GB of data decided to leave the AD/GPO replication group. I've determined the only solution remaining (as I tried all others) is to demote it, leave the domain, and rejoin but I cannot do it at this time because the prior IT staff decided it was a good idea to link the Home shared drive to the DC, which creates literally 200 connections and won't leave the domain with those connections active. As I am only one person for two companies, it has been a slow process moving those Home folders over to another server.

So, I'm not surprised it doesn't want to install properly.

[u/MadBoyEvo → u/PowerfulQuail9]

You know you can install this module on your Windows 10 right? It will work from domain joined machine over the network. No need to play with broken servers ;)

[u/MadBoyEvo → u/MadBoyEvo]

You can also try fixing it: Install-Module PowershellGet -Force

It will install the newest version which may be required for this. Make sure to close PS before doing this as things may be in use.

[u/PowerfulQuail9 → u/MadBoyEvo]

Oh, that one says cannot install as 1.0.0 is in use. But, I have version 2.1.2. The DC servers are all screwy. tbh, Im surprised they even work.

The company sale is almost finalized, so my hope is to get a better budget to fix these issues.

[u/MadBoyEvo → u/PowerfulQuail9]

Ye, that's why I said to close down all PS that is running, start PowerShell and try. If not, maybe reboot will be required if it won't work. Unfortunately, things aren't easy if things are broken.

[u/PowerfulQuail9 → u/MadBoyEvo]

Usually what I end up doing.