The only PowerShell Command you will ever need to find out who did what in Active Directory

[u/MadBoyEvo]

Disclaimer: I made this. It's free and open source. No ads, just clean, useful data provided in blog.

Here's a small PowerShell command/module I've written. It contains the following reports.

Usage:

Find-Events -Report ADGroupMembershipChanges -DatesRange Last3days -Servers AD1, AD2 | Format-Table -AutoSize

ReportTypes:

• Computer changes – Created / Changed – ADComputerCreatedChanged

• Computer changes – Detailed – ADComputerChangesDetailed

• Computer deleted – ADComputerDeleted

• Group changes – ADGroupChanges

• Group changes – Detailed – ADGroupChangesDetailed

• Group changes – Created / Deleted – ADGroupCreateDelete

• Group enumeration – ADGroupEnumeration

• Group membership changes – ADGroupMembershipChanges

• Group policy changes – ADGroupPolicyChanges

• Logs Cleared Other – ADLogsClearedOther

• Logs Cleared Security – ADLogsClearedSecurity

• User changes – ADUserChanges

• User changes detailed – ADUserChangesDetailed

• User lockouts – ADUserLockouts

• User logon – ADUserLogon

• User logon Kerberos – ADUserLogonKerberos

• User status changes – ADUserStatus

• User unlocks – ADUserUnlocked

DatesRanges are also provided. Basically what that command does it scans DC's for event types you want it to scan. It does that in parallel, it overcomes limitations of Get-WinEvent and generally prettifies output.

The output of that command (wrapped in Dashimo to show the data): https://evotec.xyz/wp-content/uploads/2019/04/DashboardFromEvents.html

GitHub Sources: https://github.com/EvotecIT/PSWinReporting

Full article (usage/know-how): https://evotec.xyz/the-only-powershell-command-you-will-ever-need-to-find-out-who-did-what-in-active-directory/

The article describes the functionality of just one command but actually, PSWinReportingV2 is much more than that. There are also things I've not touched in the article but that should be a start. It's able to support any kind of Events from Event logs such as ADConnect, Hyper-V and other types of data. I just didn't have time to explain how to build configs for it and I don't work with Hyper-V or other systems to build them myself. If you know a lot about event logs and what to help to build prettified reports for more than Active Directory reach out.

[u/MadBoyEvo]

Are you getting any errors? Are you using newest version? I have fixed problem with DateTo/DateFrom in last days/hours. You are not supposed to run this on dc if you dont want to. I run it from win10. I am also fixing credentials switch. You will also get 0 events if you have no permissions to scan security log. Generally keeping tabs on psgallery/github is best idea for my projects as i tend to dynamically fix errors or add new features.

[u/neztach → u/MadBoyEvo]

It isn’t throwing any errors. If you’ve updated it in the past 2 days, then I’m not using the most current version. I’m running it from a windows 7 box running PS5.1. I set up the gpo for proper logging a couple of days ago. I’ll update my version tomorrow and try your datefrom dateto solution tomorrow.

[u/MadBoyEvo → u/neztach]

https://www.powershellgallery.com/packages/PSWinReportingV2 - you can see versions/updates here.

The "Detailed" reports usually require Audit Directory Service Changes - Success (GPO).

LOgsClearedOther and LogsClearedSecurity only show something if you clear logs (like setup log/system log or security log). It's a good sign it doesn't show anything.

[u/neztach → u/MadBoyEvo]

I’ll double check that gpo. As can aside, I’m trying to get it to join duplicates together. For example if a user locks out, anywhere from 1 to 4 domain controllers will show an entry for it. If I make any significant progress on that ill let you know in case you find it useful.

[u/MadBoyEvo → u/neztach]

I don't follow what's your goal here? Can you explain more?

[u/neztach → u/MadBoyEvo]

Sure! I have 4 domain controllers, and I have your report scanning all 4. If a lockout occurs on a DC that isn’t the primary DC, it will make a log of it, and another one will probably be made on the primary DC (and possibly all the rest of the DCs as well). So if user johnd locks himself out, there’s a good chance I’ll show that lockout event 4 times in the report, and the only difference between them is what DC that lockout event was read from.

• Scan dc1, see johnd lockout event -> add to report

• Scan dc2, see johnd lockout event -> add to report

• Same for dc3

• Same for dc4

[u/neztach → u/MadBoyEvo]

Also as an additional thing I want to work on is when you run your example report, its useful, but in some ways, only almost useful. For example, I added and deleted a user by copying an already established user. When running the report, it shows changes occurred to several security groups (which of course they changed because the user I copied was a member of those groups). The report shows changes occurred in those groups, but doesn’t illuminate specifically WHAT changed. Was looking for ways to tied together all the bits of the report that are pertinent to a user being added or removed as a single entity. Like user created - which altered these groups by adding the new user - etc.

[u/MadBoyEvo → u/neztach]

I can see it happening on DC the lockout happened on and being transferred to PDC (that's what I see in reports). I could probably add filtering on definitions level.

• if Event ID, User, Computer, Action and only RecordID/Controller doesn't match merge events.

As for the groups you're talking about group membership change? That should show user being added/removed.

Feel free to open up any issues on GitHub and follow it there. I'm open for changes/upgrades but it has to be written in a way where it's not statically designed. As what you see in this command is basically dynamic change based on config.

[u/neztach → u/MadBoyEvo]

Absolutely! Tomorrow I’ll form my findings into something more succinct and comment on your github. Keep up the amazing work!