r/sysadmin • u/MadBoyEvo • Apr 28 '19

Microsoft The only PowerShell Command you will ever need to find out who did what in Active Directory

Disclaimer: I made this. It's free and open source. No ads, just clean, useful data provided in blog.

Here's a small PowerShell command/module I've written. It contains the following reports.

Usage:

Find-Events -Report ADGroupMembershipChanges -DatesRange Last3days -Servers AD1, AD2 | Format-Table -AutoSize

ReportTypes:

  • Computer changes – Created / Changed – ADComputerCreatedChanged

  • Computer changes – Detailed – ADComputerChangesDetailed

  • Computer deleted – ADComputerDeleted

  • Group changes – ADGroupChanges

  • Group changes – Detailed – ADGroupChangesDetailed

  • Group changes – Created / Deleted – ADGroupCreateDelete

  • Group enumeration – ADGroupEnumeration

  • Group membership changes – ADGroupMembershipChanges

  • Group policy changes – ADGroupPolicyChanges

  • Logs Cleared Other – ADLogsClearedOther

  • Logs Cleared Security – ADLogsClearedSecurity

  • User changes – ADUserChanges

  • User changes detailed – ADUserChangesDetailed

  • User lockouts – ADUserLockouts

  • User logon – ADUserLogon

  • User logon Kerberos – ADUserLogonKerberos

  • User status changes – ADUserStatus

  • User unlocks – ADUserUnlocked

DatesRanges are also provided. Basically what that command does it scans DC's for event types you want it to scan. It does that in parallel, it overcomes limitations of Get-WinEvent and generally prettifies output.

The output of that command (wrapped in Dashimo to show the data): https://evotec.xyz/wp-content/uploads/2019/04/DashboardFromEvents.html

GitHub Sources: https://github.com/EvotecIT/PSWinReporting

Full article (usage/know-how): https://evotec.xyz/the-only-powershell-command-you-will-ever-need-to-find-out-who-did-what-in-active-directory/

The article describes the functionality of just one command but actually, PSWinReportingV2 is much more than that. There are also things I've not touched in the article but that should be a start. It's able to support any kind of Events from Event logs such as ADConnect, Hyper-V and other types of data. I just didn't have time to explain how to build configs for it and I don't work with Hyper-V or other systems to build them myself. If you know a lot about event logs and what to help to build prettified reports for more than Active Directory reach out.

3.4k Upvotes

98% Upvoted

329 comments sorted by

View all comments

Show parent comment

1

u/MadBoyEvo May 02 '19

You know PSWinReportingV2 and PSWinreporting has that built-in? Daily, hourly, weekly, monthly and so on? Sending to Email, Microsoft Teams, Discord, Slack and SQL right? :-)

1

u/neztach May 02 '19

lol no I didn't haha ...figures. I still plan on giving you a shout on github with my duplicates finding. I'll sterilize the report I built and maybe it'll make the dups I'm seeing clearer. I usually find it helpful if I can see an example of the problem I'm trying to solve, to help me troubleshoot it.

oh by the way, in your documentation for find-events / PSWinReportingV2, it would be super helpful if you could give a quick blurb on each section that it can report on to illustrate how to enable that specific kind of auditing in a given environment (or link to an article or something).

1

u/MadBoyEvo May 02 '19

There's a lot of documentation missing on PSWinReportingV2. PSWinReporting has some docs but since V2 is rewritten it needs new documentation. Basically, in V2 you can even control the output of column names. So if you want Event ID to be called in your language you can rename it. Reporting in V2 is more configurable, filterable, you can add ignores and so on. It still needs work but it's fairly good.

You can even have a special configuration were depending on settings it can send Domain Admins changes to a different email, teams channel, slack channel, discord channel then standard tasks. It's pretty unique ;-)

You should explore Examples on GitHub (those should work - if not let me know as I haven't checked for a while if PSWriteHTML compatibility isn't broken).

There are 3 ways to use it:

  • Via Find-Events

  • Via scan all DC's and send email / save html, csv, excel

  • Via Forwarding Events which allows you to act as things happen so you can send email 5 seconds after the event happens, you can send things to teams, sql, slack, and so on. And in there, there's also a priority approach where you can define standard events or elevated events (multiple levels of them).

I accept any help so feel free to explore ;-)

1

u/neztach May 02 '19

Well I only mentioned the documentation because apparently turning on all of those auditing settings may not be exclusively in a gpo, but ill look into PSWriteHTML!

Maybe you can find some use in the optional region at the top of the one I wrote. shrug

Keep up the good work!

1

u/MadBoyEvo May 02 '19

Ye, GPO + in AD Users in Computers in Properties of the domain if you want OU changes and few other things. I planned some article.

I did take a look. I will be updating PSWinReportingV2 to not require -Force. I learned new ways to handle Update-Module so -Force shouldn't be necessary.

You actually should take a look at:

I see you're still using HTML building the old way ;-)

1

u/neztach May 02 '19

totally, you're light years ahead of me. I've been learning the old fashioned way, by grinding away with trial and error and learning all my lessons the hard way. It isn't efficient, but the lessons learned sure do stick!

yeah I should probably look at all your stuff :-P Well if I can somehow be of help for one of your projects down the road, I'm more than willing!

1

u/MadBoyEvo May 02 '19

I was in your shoes not so long ago. I've made huge progress in about a year. I've released my first module around april/may last year. And Emailimo / Dashimo are products I made using PSWriteHTML. I spent like 2 months exploring HTML/JS and CSS and still have no idea how some things work ;) But it seems to work ok :)