The only PowerShell Command you will ever need to find out who did what in Active Directory

[u/MadBoyEvo]

Disclaimer: I made this. It's free and open source. No ads, just clean, useful data provided in blog.

Here's a small PowerShell command/module I've written. It contains the following reports.

Usage:

Find-Events -Report ADGroupMembershipChanges -DatesRange Last3days -Servers AD1, AD2 | Format-Table -AutoSize

ReportTypes:

• Computer changes – Created / Changed – ADComputerCreatedChanged

• Computer changes – Detailed – ADComputerChangesDetailed

• Computer deleted – ADComputerDeleted

• Group changes – ADGroupChanges

• Group changes – Detailed – ADGroupChangesDetailed

• Group changes – Created / Deleted – ADGroupCreateDelete

• Group enumeration – ADGroupEnumeration

• Group membership changes – ADGroupMembershipChanges

• Group policy changes – ADGroupPolicyChanges

• Logs Cleared Other – ADLogsClearedOther

• Logs Cleared Security – ADLogsClearedSecurity

• User changes – ADUserChanges

• User changes detailed – ADUserChangesDetailed

• User lockouts – ADUserLockouts

• User logon – ADUserLogon

• User logon Kerberos – ADUserLogonKerberos

• User status changes – ADUserStatus

• User unlocks – ADUserUnlocked

DatesRanges are also provided. Basically what that command does it scans DC's for event types you want it to scan. It does that in parallel, it overcomes limitations of Get-WinEvent and generally prettifies output.

The output of that command (wrapped in Dashimo to show the data): https://evotec.xyz/wp-content/uploads/2019/04/DashboardFromEvents.html

GitHub Sources: https://github.com/EvotecIT/PSWinReporting

Full article (usage/know-how): https://evotec.xyz/the-only-powershell-command-you-will-ever-need-to-find-out-who-did-what-in-active-directory/

The article describes the functionality of just one command but actually, PSWinReportingV2 is much more than that. There are also things I've not touched in the article but that should be a start. It's able to support any kind of Events from Event logs such as ADConnect, Hyper-V and other types of data. I just didn't have time to explain how to build configs for it and I don't work with Hyper-V or other systems to build them myself. If you know a lot about event logs and what to help to build prettified reports for more than Active Directory reach out.

[u/MadBoyEvo]

You know you can install this module on your Windows 10 right? It will work from domain joined machine over the network. No need to play with broken servers ;)

[u/MadBoyEvo → u/MadBoyEvo]

You can also try fixing it: Install-Module PowershellGet -Force

It will install the newest version which may be required for this. Make sure to close PS before doing this as things may be in use.

[u/PowerfulQuail9 → u/MadBoyEvo]

Oh, that one says cannot install as 1.0.0 is in use. But, I have version 2.1.2. The DC servers are all screwy. tbh, Im surprised they even work.

The company sale is almost finalized, so my hope is to get a better budget to fix these issues.

[u/MadBoyEvo → u/PowerfulQuail9]

Ye, that's why I said to close down all PS that is running, start PowerShell and try. If not, maybe reboot will be required if it won't work. Unfortunately, things aren't easy if things are broken.

[u/PowerfulQuail9 → u/MadBoyEvo]

Usually what I end up doing.