Scroll Top
Evotec Services sp. z o.o., ul. Drozdów 6, Mikołów, 43-190, Poland
+48 502 469 760
[email protected]

Monitoring User, Groups Changes in Active Directory – version 0.8

Monitoring User, Groups Changes in Active Directory – version 0.8
img_5ad658be73778
By Przemyslaw Klys Active Directory PowerShell Windows 17 kwietnia, 2018
Little introduction

Event Monitoring solution written in PowerShell is an event library (Get-EventsLibrary.ps1) script that parses Security (mostly) logs on Domain Controllers. It has few reports capabilities including sending group membership changes, user changes, user lockouts, user creation, user password change. While many other scripts provide similar capabilities… It's most important thing is … WHO did the change, WHEN the change happend!

When setup as Task Schedule it can send daily, weekly, monthly, quarterly (and so on) reports to your email about changes happening in your domain.

For example:
You can easily see user being added or removed from Domain Admins group
You can easily change your HelpDesk agent did change of password for your boss 

In this version I've further optimized code and added some more health checks so that the process is a bit smoother. You can go straight to Get-EventsLibrary.ps1 if you don't fancy reading what has changed… although there was quite a lot of changes so I would encourage everyone to take a minute to read up.

PSWinReporting Information
Please notice this article contains parts of information (still useful) and may not reflect all functionalities of this module. For download, source code and so on you should refer to the dedicated PSWinReporting module page. After reading this one… of course! It contains useful information, examples and know-how.
What has changed?
    [accordionitem] Basic – Rebuilt config file (again, sorry for that) – Rebuilt Test-Configuration to report what's wrong with configuration (limited capability) – Changes and fixes for Send-Mail function – Few other changes New Dates – ReportPastHour – if it's 23:22 it will report 22:00 till 23:00 – ReportCurrentHour – if it's 23:22 it will report 23:00 till 00:00 – ReportOnDay – weekly report – choose a day to send the report – ReportCurrentDayMinusDayX – goes back X days and shows just 1 day – ReportCurrentDayMinuxDaysX – goes back X days and shows all days till today – ReportCustomDate – custom dates New reports: – IncludeEventLogSize – – Preparations for IncludeGroupPolicyChanges – doesn't work yet (DO NOT SET TO TRUE) – Preparations for IncludeClearedLogs – doesn't work yet (DO NOT SET TO TRUE) – Preparations for IncludeLogonEvents – doesn't work yet (DO NOT SET TO TRUE) New options: – SendMail – setting deciding if report should be sent (you may want to just keep the XLSX/CSV files) – KeepReports – when set files are kept, if not files are deleted after sending – Added AsCSV – althought it's easier to work with Excel – JustTestPrerequisite – checks config file for errors and terminates [/accordionitem] [accordionitem] Basic – Fixed display issues with Write-Color inconsistency – Fixed small code optimizations – Added error handling for event listng (would error out on Windows 2003 controllers) – only Windows 2008/R2 and up are supported – Added Supported column – Moved Test-Prerequisite from config file to Library [/accordionitem] [accordionitem] Basic – Changed configuration settings – Added option to attach excel files instead of inline html tables – Added option to send via relay smtp (just put empty string in EmailServerLogin – probably port 25 but depends on configuration of server) – Added verification if modules are available – Added verification if Get-EventsLibrary.ps1 is available – Added verification if configuration is consistent (all required options defined) – doesn't check for values – this should prevent possible issues with new versions of Get-EventsLibrary.ps1 – Added report for custom dates – Added option to choose AsHTML or/and AsExcel – you can have Excel attached along with tables inline in email or just one of those [/accordionitem] [accordionitem] – First public version [/accordionitem]
What's new in this version - details

There were several features added and changes to configuration file.

Rebuilt config file (again, sorry for that)
Changes and fixes for Send-Mail function
Few other fixes

Support for new dates
ReportPastHour – if it's 23:22 it will report 22:00 till 23:00
ReportCurrentHour – if it's 23:22 it will report 23:00 till 00:00
ReportOnDay – weekly report – choose a day to send the report – essentially you can pick any day „Monday„, „Tuesday„, „Wednesday„, „Thursday” and so on. You can actually have it send report on „Monday”, „Friday” if you wish. 
ReportCurrentDayMinusDayX – goes back X days and shows just 1 day
ReportCurrentDayMinuxDaysX – goes back X days and shows all days till today
ReportCustomDate – custom dates, just in case you want to check something quickly 

New reports
IncludeEventLogSize – this one makes sure you're informed on how your logs are growing – it supports adding multiple log names. Below it shows Security log but you can put „Security”, „Application” and so on… as long as those exists on the system it will report for them.  

While 3 new options showed up… please do not use them as those are working incorrectly and may trigger your script into loop.

Preparations for IncludeGroupPolicyChanges – doesn't work yet (DO NOT SET TO TRUE)
Preparations for IncludeClearedLogs – doesn't work yet (DO NOT SET TO TRUE) – but the goal is to report who / when did the reset of logs. It's useful if someone wants to cover his tracks or has a habit of cleaning up logs. 
Preparations for IncludeLogonEvents – doesn't work yet (DO NOT SET TO TRUE)

New features

SendMail – setting deciding if report should be sent (you may want to just keep the XLSX/CSV files on filesystem)
KeepReports – when set files are kept, if not files are deleted after sending
AsCSV – although it's easier to work with Excel in some cases you may want to save reports to CSV.
New feature – JustTestPrerequisite – checks config file for errors and terminates. Additionally as part of this feature I've rebuilt Test-Configuration function to report what's wrong with configuration. This should give you idea what is missing in config files.

Known issues

At this moment there are several not finished features. The most visible are:

Configuration options – IncludeLogonEvents are not working correctly
Configuration options – IncludeDomainControllersReboots contains more information then needed
Configuration options – IncludeClearedLogs switch is not working
Configuration options – IncludeGroupPolicyChanges swich is not working yet (keeps reports saved by default)
Przemyslaw Klys / About Author
System Architect with over 14 years of experience in the IT field. Skilled, among others, in Active Directory, Microsoft Exchange and Office 365. Profoundly interested in PowerShell. Software geek.
More posts by Przemyslaw Klys

Posty powiązane

Format-Table
Does having Format-Table or Format-List in the middle of the pipeline makes sense?
Recently there was this discussion on PowerShell Group on Facebook about issue posted by one user. While the subject doesn’t matter for this post, few people commented on the idea that he was using Format-Table in the middle of the pipeline to do something. They all said Format-Table should be used as last in the pipeline. Otherwise, you would get the wrong output. But should it? Well, it depends!
24 kwi 2019
Invoke-RestMethod Error
Invoke-RestMethod : The underlying connection was closed: An unexpected error occurred on a send while connecting Graph API
In the last few days, I’ve got two reports that my PowerShell module for Office 365 Health suddenly started giving errors. This was a bit weird because it worked perfectly fine on my end. But while I could understand one person having an issue of their own, with their network or firewalls, if the second person comes along with the same report, that means something else is going on.
14 gru 2019
Getting Bitlocker and LAPS summary report with PowerShell
Having Bitlocker and LAPS in modern Active Directory is a must. But just because you enable GPO and have a process that should say Bitlocker and LAPS are enabled doesn’t mean much. Now and then you should verify things yourself. One of the Facebook users on PowerShell group just had this idea of exporting Bitlocker keys and then giving that list to his colleagues for manual verification. He wanted to do it half PowerShell and half manually. While the idea was great, why not take full advantage of PowerShell and have a helpful report with all the necessary information?
11 lip 2019
PSWinDocumentation – Version 0.1 with Word / Excel export
A few weeks ago I’ve released my first version of PSWinDocumentation. It was simple, one command module where you start it and get some basic AD stuff into Microsoft Word document. Today… I’m releasing a new version that has a bit bigger feature set. Are you ready for it? Let’s go!
23 sie 2018
PSWinReporting - Find-Events
The only PowerShell Command you will ever need to find out who did what in Active Directory
While the title of this blog may be a bit exaggeration, the command I’m trying to show here does it’s best to deliver on the promise. What you’re about to witness here is something I’ve worked on for a while now, and it meets my basic needs. If you don’t have SIEM product or products that monitor who does what in Active Directory this command makes it very easy, even for people who don’t have much experience in reading Event Logs. If you’d like to learn about working with Windows Event Logs here’s a great article I wrote recently – PowerShell – Everything you wanted to know about Event Logs and then some.
28 kwi 2019
Get DNS Duplicate Entries
Finding duplicate DNS entries using PowerShell
Today’s blog post is about Active Directory-integrated DNS and how to find duplicate entries. By duplicate, I mean those where one DNS name matches multiple IP addresses. While some duplicate DNS entries are expected, in other cases, it may lead to problems. For example, having a static IP assigned to a hostname that later on is also updated with dynamic entries.
24 lip 2022
LAPS and Bitlocker
Backing up Bitlocker Keys and LAPS passwords from Active Directory
Having a modern, secure infrastructure in 2019 is a requirement. You should implement BitLocker to make sure that in the event of stolen laptop data is not readily extractable and implementing LAPS is a must in a fast changing IT world. But I’m not here to convince you to those two security features. I’m here to show you an easy way to backup LAPS and BitLocker. While having everything stored in Active Directory is excellent, things can get complicated when you don’t have access to your Active Directory, or you restore an older version of it. You see, LAPS, for example, keeps only last Administrator password. This is great and all but what happens if you restore the machine from backup from 6 months back? Your password has already changed multiple times. During our testing of DR scenarios, we wanted to access the computer via their local Administrator credentials and we just couldn’t because that password was already gone.
31 mar 2019
Office 365 Health Service
Office 365 Health Service using PowerShell
Two years ago, I wrote a PowerShell module called PSWinDocumentation.O365HealthService. The idea was simple – replicate Health Service data Microsoft offers in Office Portal so you can do with data whatever you want and display it however you like. I’ve written about it in this blog post. A few weeks back, someone reported that the module stopped working, and  I’ve confirmed it indeed no longer works! Initially, I thought that maybe some data format changed, as it changed multiple times, or perhaps the date format was wrong again, but no. Microsoft has deprecated Office 365 Service Communications API reference and instead tells us that Service Health is now only available via Microsoft Graph API. Is it only me who didn’t get the memo about this?
14 lut 2022
PSWinDocumentation - Password Quality
PSWinDocumentation – Audit Active Directory Passwords
If you’re paying attention to what’s happening around the world now you probably know Have I Been Pwned service by now. You probably know that it has huge lists of hashes of passwords that leaked out over the years from different services (LinkedIn, Adobe, and so on). This means those passwords are now in possession of good guys, but also bad guys. With Active Directory being often a central place to store your password that allows you to access your Office 365 account, ADFS, Microsoft Exchange it’s important that your AD passwords is both secure and safe. Bad guys may want to try and access your email accounts or other data that’s available online. And having a list of passwords you or other people may have used before doesn’t help you in protecting your own data.
07 paź 2018
Update-Module – PackageManagement\Install-Package : Unable to find repository
19 paź 2018
PowerShellBlack
Remove-Item : Access to the cloud file is denied while deleting files from OneDrive
I like OneDrive. It allows me to keep my data secure and always synchronized. If things go wrong, I can always get it back. I use it for almost everything. Even for my PowerShell projects, which are committed to GitHub, so in theory, I shouldn’t need that. But every once in a while, I make some stupid mistake and delete a file that has yet not been committed to GitHub, and that’s where the OneDrive comes in handy. Quick restore, and we’re back. Unfortunately, sometimes things aren’t as I would expect them to work. For example, let’s have a look at this nice list of markdown files that are documentation for my module called GPOZaurr.
06 gru 2020
Export-CliXML and Import-CliXML serialization woes
I’ve been working today trying to deliver to one of my Clients Active Directory documentation. To my surprise, something that worked fine for a very long time has started to provide weird results. So, after spending about 8 hours taking apart a few of my PowerShell modules trying to find out what is wrong finally, I’ve found it: Export-CliXML / Import-CliXML. Those two commands are great. I’ve used them multiple times with great success (or so I thought).
23 cze 2019
PSTeams - Cross-Platform
PSTeams – Send notifications to MS Teams from Mac / Linux or Windows
04 paź 2018
PowerShell – Single PSM1 file versus multi-file modules
I’ve been working with PowerShell Modules for a while now, and most of my knowledge about them came from Warren F (psCookieMonster) blog about Building a PowerShell Module. It is a handy piece of information and recommended read for anyone starting up writing PowerShell Modules. He introduces an idea where a module is stored in multiple folders Private, Public, Bin, Lib and so on and having YourModule.psm1 as a wrapper for functions, binaries in those folders, where each function is stored in its file. It’s an excellent concept, and I use it every day. It allows me to jump into a file quickly I want to find and fundamentally easier for development, especially in teams.
16 lis 2018
Active Directory DFS Health Check with PowerShell
One of the critical parts of Active Directory is DFS. It allows you to share same NETLOGON/SYSVOL folders across all Domain Controllers in your Forest. Its health is vital to the functionality of your Active Directory. If it’s broken, a lot of things may not work, and it’s not that easy to tell the status of it. At first sight, everything may seem to work correctly, but if you take a closer look – not so much. It’s great if you find it out by yourself, but not fun if suddenly GPO’s don’t apply to some users, computers, and you find out a year later.
20 lut 2020