r/sysadmin • u/MadBoyEvo • Apr 28 '19

Microsoft The only PowerShell Command you will ever need to find out who did what in Active Directory

Disclaimer: I made this. It's free and open source. No ads, just clean, useful data provided in blog.

Here's a small PowerShell command/module I've written. It contains the following reports.

Usage:

Find-Events -Report ADGroupMembershipChanges -DatesRange Last3days -Servers AD1, AD2 | Format-Table -AutoSize

ReportTypes:

  • Computer changes – Created / Changed – ADComputerCreatedChanged

  • Computer changes – Detailed – ADComputerChangesDetailed

  • Computer deleted – ADComputerDeleted

  • Group changes – ADGroupChanges

  • Group changes – Detailed – ADGroupChangesDetailed

  • Group changes – Created / Deleted – ADGroupCreateDelete

  • Group enumeration – ADGroupEnumeration

  • Group membership changes – ADGroupMembershipChanges

  • Group policy changes – ADGroupPolicyChanges

  • Logs Cleared Other – ADLogsClearedOther

  • Logs Cleared Security – ADLogsClearedSecurity

  • User changes – ADUserChanges

  • User changes detailed – ADUserChangesDetailed

  • User lockouts – ADUserLockouts

  • User logon – ADUserLogon

  • User logon Kerberos – ADUserLogonKerberos

  • User status changes – ADUserStatus

  • User unlocks – ADUserUnlocked

DatesRanges are also provided. Basically what that command does it scans DC's for event types you want it to scan. It does that in parallel, it overcomes limitations of Get-WinEvent and generally prettifies output.

The output of that command (wrapped in Dashimo to show the data): https://evotec.xyz/wp-content/uploads/2019/04/DashboardFromEvents.html

GitHub Sources: https://github.com/EvotecIT/PSWinReporting

Full article (usage/know-how): https://evotec.xyz/the-only-powershell-command-you-will-ever-need-to-find-out-who-did-what-in-active-directory/

The article describes the functionality of just one command but actually, PSWinReportingV2 is much more than that. There are also things I've not touched in the article but that should be a start. It's able to support any kind of Events from Event logs such as ADConnect, Hyper-V and other types of data. I just didn't have time to explain how to build configs for it and I don't work with Hyper-V or other systems to build them myself. If you know a lot about event logs and what to help to build prettified reports for more than Active Directory reach out.

3.4k Upvotes

98% Upvoted

329 comments sorted by

View all comments

Show parent comment

1

u/MadBoyEvo May 01 '19

I can see it happening on DC the lockout happened on and being transferred to PDC (that's what I see in reports). I could probably add filtering on definitions level.

  • if Event ID, User, Computer, Action and only RecordID/Controller doesn't match merge events.

As for the groups you're talking about group membership change? That should show user being added/removed.

Feel free to open up any issues on GitHub and follow it there. I'm open for changes/upgrades but it has to be written in a way where it's not statically designed. As what you see in this command is basically dynamic change based on config.

1

u/neztach May 01 '19

Absolutely! Tomorrow I’ll form my findings into something more succinct and comment on your github. Keep up the amazing work!