Solved

Track Active Directory Account Creation, Group Membership, and Deletion

Posted on 2013-12-07
3
832 Views
Last Modified: 2013-12-09
For purposes of change management and compliance:

How can I track when a new AD account is created in our environment and who created it.

I need to ensure that when new accounts are created they correspond to our internal ticketing system.

Ideally I'd like to receive an e-mail alert when a new account is created.

Is there any *free*, Windows Server 2008 built in functionality that can provide this?

I understand there are many 3rd party products, but I need something internal through scripting and automation.
0
Comment
Question by:fireguy1125
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 57

Assisted Solution

by:Mike Kline
Mike Kline earned 250 total points
ID: 39703352
You can attach tasks to events  http://portal.sivarajan.com/2010/04/generate-email-alert-to-event-attach.html

You have to have the auditing enabled to track the events.    If you search around you will find other scripts.

I won't post links to any 3rd party products since you are aware.  They make this much easier but as you know they are not free.

Thanks

Mike
0
 
LVL 14

Accepted Solution

by:
Ram Balachandran earned 250 total points
ID: 39703364
Combining Active Directory Auditing and Schedule is a free option.

Enable Active Directory Auditing: http://technet.microsoft.com/en-us/library/cc731607(v=ws.10).aspx

Scheduled task to email with an event log trigger: http://blogs.technet.com/b/jhoward/archive/2010/06/16/getting-event-log-contents-by-email-on-an-event-log-trigger.aspx
---

You can also use powershell to get list of IDs created , change 30 to how many you wish

 
Import-Module ActiveDirectory
$When = ((Get-Date).AddDays(-30)).Date
Get-ADUser -Filter * -Properties whenCreated | Where-Object {$_.whenCreated -ge $When}

Open in new window

0
 
LVL 53

Expert Comment

by:Will Szymkowski
ID: 39703417
Best tool I have used for Auditing purposes at a low cost is AD Audit Plus. Great tool and they have a fully featured 30 day trial. Basically tells you everything that is happening in your environment, you might be surprised on what it shows.

ADAudit Plus  - http://www.manageengine.com/products/active-directory-audit/

Will.
0

Featured Post

Office 365 Training for IT Pros

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Auditing domain password hashes is a commonly overlooked but critical requirement to ensuring secure passwords practices are followed. Methods exist to extract hashes directly for a live domain however this article describes a process to extract u…
Uncontrolled local administrators groups within any organization pose a huge security risk. Because these groups are locally managed it becomes difficult to audit and maintain them.
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

695 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question