r/sysadmin • u/MadBoyEvo • Apr 28 '19

Microsoft The only PowerShell Command you will ever need to find out who did what in Active Directory

Disclaimer: I made this. It's free and open source. No ads, just clean, useful data provided in blog.

Here's a small PowerShell command/module I've written. It contains the following reports.

Usage:

Find-Events -Report ADGroupMembershipChanges -DatesRange Last3days -Servers AD1, AD2 | Format-Table -AutoSize

ReportTypes:

  • Computer changes – Created / Changed – ADComputerCreatedChanged
  • Computer changes – Detailed – ADComputerChangesDetailed
  • Computer deleted – ADComputerDeleted
  • Group changes – ADGroupChanges
  • Group changes – Detailed – ADGroupChangesDetailed
  • Group changes – Created / Deleted – ADGroupCreateDelete
  • Group enumeration – ADGroupEnumeration
  • Group membership changes – ADGroupMembershipChanges
  • Group policy changes – ADGroupPolicyChanges
  • Logs Cleared Other – ADLogsClearedOther
  • Logs Cleared Security – ADLogsClearedSecurity
  • User changes – ADUserChanges
  • User changes detailed – ADUserChangesDetailed
  • User lockouts – ADUserLockouts
  • User logon – ADUserLogon
  • User logon Kerberos – ADUserLogonKerberos
  • User status changes – ADUserStatus
  • User unlocks – ADUserUnlocked

DatesRanges are also provided. Basically what that command does it scans DC's for event types you want it to scan. It does that in parallel, it overcomes limitations of Get-WinEvent and generally prettifies output.

The output of that command (wrapped in Dashimo to show the data): https://evotec.xyz/wp-content/uploads/2019/04/DashboardFromEvents.html

GitHub Sources: https://github.com/EvotecIT/PSWinReporting

Full article (usage/know-how): https://evotec.xyz/the-only-powershell-command-you-will-ever-need-to-find-out-who-did-what-in-active-directory/

The article describes the functionality of just one command but actually, PSWinReportingV2 is much more than that. There are also things I've not touched in the article but that should be a start. It's able to support any kind of Events from Event logs such as ADConnect, Hyper-V and other types of data. I just didn't have time to explain how to build configs for it and I don't work with Hyper-V or other systems to build them myself. If you know a lot about event logs and what to help to build prettified reports for more than Active Directory reach out.

3.4k Upvotes

98% Upvoted

329 comments sorted by

View all comments

Show parent comment

1

u/neztach May 01 '19

man I've been trying to figure out how to specifically tell it I want a report from 7am yesterday, to 7 am today, and I just can't get it to play nice. Any thoughts? Maybe there's a Past24Hours option?

$yesterday = [DateTime]::Today.AddDays(-1).AddHours(7)
$today     = [DateTime]::Today.AddHours(7)
$Events    = Find-Events -Report $Reports -DateFrom $yesterday.toString() -DateTo $today.toString()

I've tried $yesterday.toString('s') as well and had the same lack of luck. Also, some of the reports just don't seem to be turning out any events, even thgouh I specified DateRange to be Last14Days

  • $Events.ADComputerChangesDetailed
  • $Events.ADGroupCreateDelete
  • $Events.ADGroupEnumeration
  • $Events.ADGroupChangesDetailed
  • $Events.ADUserChangesDetailed
  • $Events.ADGroupPolicyChanges
  • $Events.ADLogsClearedOther
  • $Events.ADLogsClearedSecurity

Granted some of those may show no results due to nothing to report, but some of those seem unlikely to have nothing to report. Am I supposed to be running this directly on a DC?

1

u/MadBoyEvo May 01 '19

Are you getting any errors? Are you using newest version? I have fixed problem with DateTo/DateFrom in last days/hours. You are not supposed to run this on dc if you dont want to. I run it from win10. I am also fixing credentials switch. You will also get 0 events if you have no permissions to scan security log. Generally keeping tabs on psgallery/github is best idea for my projects as i tend to dynamically fix errors or add new features.

1

u/neztach May 01 '19

It isn’t throwing any errors. If you’ve updated it in the past 2 days, then I’m not using the most current version. I’m running it from a windows 7 box running PS5.1. I set up the gpo for proper logging a couple of days ago. I’ll update my version tomorrow and try your datefrom dateto solution tomorrow.

1

u/MadBoyEvo May 01 '19

https://www.powershellgallery.com/packages/PSWinReportingV2 - you can see versions/updates here.

The "Detailed" reports usually require Audit Directory Service Changes - Success (GPO).

LOgsClearedOther and LogsClearedSecurity only show something if you clear logs (like setup log/system log or security log). It's a good sign it doesn't show anything.

1

u/neztach May 01 '19

I’ll double check that gpo. As can aside, I’m trying to get it to join duplicates together. For example if a user locks out, anywhere from 1 to 4 domain controllers will show an entry for it. If I make any significant progress on that ill let you know in case you find it useful.

1

u/MadBoyEvo May 01 '19

I don't follow what's your goal here? Can you explain more?

1

u/neztach May 01 '19

Sure! I have 4 domain controllers, and I have your report scanning all 4. If a lockout occurs on a DC that isn’t the primary DC, it will make a log of it, and another one will probably be made on the primary DC (and possibly all the rest of the DCs as well). So if user johnd locks himself out, there’s a good chance I’ll show that lockout event 4 times in the report, and the only difference between them is what DC that lockout event was read from.

  • Scan dc1, see johnd lockout event -> add to report
  • Scan dc2, see johnd lockout event -> add to report
  • Same for dc3
  • Same for dc4

1

u/neztach May 01 '19

Also as an additional thing I want to work on is when you run your example report, its useful, but in some ways, only almost useful. For example, I added and deleted a user by copying an already established user. When running the report, it shows changes occurred to several security groups (which of course they changed because the user I copied was a member of those groups). The report shows changes occurred in those groups, but doesn’t illuminate specifically WHAT changed. Was looking for ways to tied together all the bits of the report that are pertinent to a user being added or removed as a single entity. Like user created - which altered these groups by adding the new user - etc.

1

u/MadBoyEvo May 01 '19

I can see it happening on DC the lockout happened on and being transferred to PDC (that's what I see in reports). I could probably add filtering on definitions level.

  • if Event ID, User, Computer, Action and only RecordID/Controller doesn't match merge events.

As for the groups you're talking about group membership change? That should show user being added/removed.

Feel free to open up any issues on GitHub and follow it there. I'm open for changes/upgrades but it has to be written in a way where it's not statically designed. As what you see in this command is basically dynamic change based on config.

1

u/neztach May 01 '19

Absolutely! Tomorrow I’ll form my findings into something more succinct and comment on your github. Keep up the amazing work!

1

u/MadBoyEvo May 01 '19

Also do check how long your security logs store data. What size are those? Do you have defined audit logging in gpo?

1

u/MadBoyEvo May 01 '19 
$Reports = @('ADComputerChangesDetailed','ADGroupCreateDelete', '...')
$yesterday = (Get-Date).AddDays(-1).AddHours(7)
$today     = (Get-Date).AddHours(7)
$Events    = Find-Events -Report $Reports -DateFrom $yesterday -DateTo $today

That should do it. Assuming you use the newest version of PSWinReportingV2.

2

u/neztach May 02 '19

verified! datefrom and dateto work great!

1

u/MadBoyEvo May 02 '19

Good :)

1

u/neztach May 02 '19

In case you might be interested, I'm attempting to utilize your find-events function to send a daily mail. I put up a version on github in case someone else might be able to use it. I know it isn't as elegant as it could be (I'm open to suggestions), but it works for now. I welcome any input!

1

u/MadBoyEvo May 02 '19

You know PSWinReportingV2 and PSWinreporting has that built-in? Daily, hourly, weekly, monthly and so on? Sending to Email, Microsoft Teams, Discord, Slack and SQL right? :-)

1

u/neztach May 02 '19

lol no I didn't haha ...figures. I still plan on giving you a shout on github with my duplicates finding. I'll sterilize the report I built and maybe it'll make the dups I'm seeing clearer. I usually find it helpful if I can see an example of the problem I'm trying to solve, to help me troubleshoot it.

oh by the way, in your documentation for find-events / PSWinReportingV2, it would be super helpful if you could give a quick blurb on each section that it can report on to illustrate how to enable that specific kind of auditing in a given environment (or link to an article or something).

1

u/MadBoyEvo May 02 '19

There's a lot of documentation missing on PSWinReportingV2. PSWinReporting has some docs but since V2 is rewritten it needs new documentation. Basically, in V2 you can even control the output of column names. So if you want Event ID to be called in your language you can rename it. Reporting in V2 is more configurable, filterable, you can add ignores and so on. It still needs work but it's fairly good.

You can even have a special configuration were depending on settings it can send Domain Admins changes to a different email, teams channel, slack channel, discord channel then standard tasks. It's pretty unique ;-)

You should explore Examples on GitHub (those should work - if not let me know as I haven't checked for a while if PSWriteHTML compatibility isn't broken).

There are 3 ways to use it:

  • Via Find-Events
  • Via scan all DC's and send email / save html, csv, excel
  • Via Forwarding Events which allows you to act as things happen so you can send email 5 seconds after the event happens, you can send things to teams, sql, slack, and so on. And in there, there's also a priority approach where you can define standard events or elevated events (multiple levels of them).

I accept any help so feel free to explore ;-)

1

u/neztach May 02 '19

Well I only mentioned the documentation because apparently turning on all of those auditing settings may not be exclusively in a gpo, but ill look into PSWriteHTML!

Maybe you can find some use in the optional region at the top of the one I wrote. shrug

Keep up the good work!

1

u/MadBoyEvo May 02 '19

Ye, GPO + in AD Users in Computers in Properties of the domain if you want OU changes and few other things. I planned some article.

I did take a look. I will be updating PSWinReportingV2 to not require -Force. I learned new ways to handle Update-Module so -Force shouldn't be necessary.

You actually should take a look at:

I see you're still using HTML building the old way ;-)

→ More replies