Solved

audit an AD account that login to a specific domain computer.

Posted on 2014-11-11
10
96 Views
Last Modified: 2014-12-03
Hi,

Is there a way I can tell a particular AD account that login to a specific domain computer remotely?

Thanks.

Ed
0
Comment
Question by:nav2567
  • 4
  • 3
  • 3
10 Comments
 
LVL 10

Expert Comment

by:JoeKlimis
ID: 40435072
Hi Ed

you can view the events using Powershell , further events can be added as required.

open a powershell window and paste in the following.   Remember to change the "localhost" to the required workstation.

get-EventLog -LogName Security -InstanceId 4624 -ComputerName localhost 

Open in new window


This will display all the successfully logins,
0
 

Author Comment

by:nav2567
ID: 40435145
I do not see the result in the output file.  Please see the attached.  

Thanks.
result.png
0
 
LVL 10

Expert Comment

by:JoeKlimis
ID: 40435188
Hi

to all the detail of each windows event  you can do this
get-EventLog -LogName Security -InstanceId 4624 -ComputerName localhost  | fl

Open in new window



If there are just specific elements you are interested in , this can be refined, let me know your exact requirements.  
Joe
0
Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

 

Author Comment

by:nav2567
ID: 40435407
Thanks.  

The result is now too much information..  

Is there a way I can display only the login ID and last login time for a particular system?

Thanks.
0
 
LVL 10

Expert Comment

by:JoeKlimis
ID: 40435543
Hi

Try this

get-EventLog -LogName Security -InstanceId 4624 -ComputerName localhost | 
select TimeGenerated,`
@{name="Username";expression={($_.message.split(":").trim()[9] -split "Acc")[0].trim()}},`
@{name="Domain";expression={$_.message.split(":").trim()[4].split("")[0]}},`
@{name="Workstation";expression={($_.message.split(":").trim()[18] -split "source")[0].trim()}}

Open in new window

0
 
LVL 17

Accepted Solution

by:
Learnctx earned 500 total points
ID: 40436309
This is a function I wrote for parsing logon events. Defaults to the localhost if a the ComputerName parameter is not set. Usage is simple:

$results = GetLogonEvents
Or
GetLogonEvents | Export-Csv -NoType whatever.csv
Or
GetLogonEvents -ComputerName ComputerNameHere

Function GetLogonEvents
{
	param (
		[string]$ComputerName = "localhost"
	)
	$ArrResults = New-Object System.Collections.ArrayList
	$regex = "(?ms)An account was (?<msad_action>.*?)[:\.]\s*\n.*New Logon:\s*\n.*?Account Name:\s*(?<user>.*?)\s*\n.*?Account Domain:\s*(?<user_domain>.*?)\s*\n.*Logon ID:\s*(?<session_id>.*?)\s*\n.*Network Information:\s\n.*?Workstation Name:\s*(?<workstation_name>.*?)\s*\n.*Source Network Address:\s*(?<source_network_address>.*?)\s*\n.*?Source Port:\s*(?<source_port>.*?)\s*\n.*"
	Write-Progress -Activity "Log Parser" -Status "Waiting" -CurrentOperation "Searching for events"
	$Events = Get-WinEvent -ComputerName $ComputerName -FilterHashtable @{logname="security";id=4624}
	$EventsTotal = $Events.Count
	$count = 0
	Foreach ($Event in $Events)
	{
		$count++
		$percent = "{0:N0}" -f $(($count/$EventsTotal)*100)
		Write-Progress -Activity "Log Parser" -Status "$percent% Complete" -CurrentOperation "Parsing events" -PercentComplete $percent
		$objResult = "" | Select time, user, user_domain, session_id, msad_action, workstation_name, source_network_address, source_port
		$objResult.Time = $Event.TimeCreated
		[void]($Event.Message -match $regex)
		$objResult.user = $matches.user
		$objResult.user_domain = $matches.user_domain
		$objResult.session_id = $matches.session_id
		$objResult.msad_action = $matches.msad_action
		$objResult.workstation_name = $matches.workstation_name
		$objResult.source_network_address = $matches.source_network_address
		$objResult.source_port = $matches.source_port
		[void]$ArrResults.Add($objResult)
	}
	return $ArrResults
}

Open in new window

0
 

Author Comment

by:nav2567
ID: 40439110
Learnctx, can I create a ps1 file and paste everything below and run it?  

GetLogonEvents -ComputerName SERVER_A

Function GetLogonEvents
{
      param (
            [string]$ComputerName = "localhost"
      )
      $ArrResults = New-Object System.Collections.ArrayList
      $regex = "(?ms)An account was (?<msad_action>.*?)[:\.]\s*\n.*New Logon:\s*\n.*?Account Name:\s*(?<user>.*?)\s*\n.*?Account Domain:\s*(?<user_domain>.*?)\s*\n.*Logon ID:\s*(?<session_id>.*?)\s*\n.*Network Information:\s\n.*?Workstation Name:\s*(?<workstation_name>.*?)\s*\n.*Source Network Address:\s*(?<source_network_address>.*?)\s*\n.*?Source Port:\s*(?<source_port>.*?)\s*\n.*"
      Write-Progress -Activity "Log Parser" -Status "Waiting" -CurrentOperation "Searching for events"
      $Events = Get-WinEvent -ComputerName $ComputerName -FilterHashtable @{logname="security";id=4624}
      $EventsTotal = $Events.Count
      $count = 0
      Foreach ($Event in $Events)
      {
            $count++
            $percent = "{0:N0}" -f $(($count/$EventsTotal)*100)
            Write-Progress -Activity "Log Parser" -Status "$percent% Complete" -CurrentOperation "Parsing events" -PercentComplete $percent
            $objResult = "" | Select time, user, user_domain, session_id, msad_action, workstation_name, source_network_address, source_port
            $objResult.Time = $Event.TimeCreated
            [void]($Event.Message -match $regex)
            $objResult.user = $matches.user
            $objResult.user_domain = $matches.user_domain
            $objResult.session_id = $matches.session_id
            $objResult.msad_action = $matches.msad_action
            $objResult.workstation_name = $matches.workstation_name
            $objResult.source_network_address = $matches.source_network_address
            $objResult.source_port = $matches.source_port
            [void]$ArrResults.Add($objResult)
      }
      return $ArrResults
}


JoeKlimis, I copy yours into a notepad and put everything in one line and run it.  That doesnt work.
0
 
LVL 17

Expert Comment

by:Learnctx
ID: 40443741
OK yeah I have written it as a function to be called. You can convert it over to a script by removing the function sections. Save it as GetEventLog.ps1 or whichever name suits best.

GetEventLog.ps1 -ComputerName Computer

	param (
		[string]$ComputerName = "localhost"
	)
	$ArrResults = New-Object System.Collections.ArrayList
	$regex = "(?ms)An account was (?<msad_action>.*?)[:\.]\s*\n.*New Logon:\s*\n.*?Account Name:\s*(?<user>.*?)\s*\n.*?Account Domain:\s*(?<user_domain>.*?)\s*\n.*Logon ID:\s*(?<session_id>.*?)\s*\n.*Network Information:\s\n.*?Workstation Name:\s*(?<workstation_name>.*?)\s*\n.*Source Network Address:\s*(?<source_network_address>.*?)\s*\n.*?Source Port:\s*(?<source_port>.*?)\s*\n.*"
	Write-Progress -Activity "Log Parser" -Status "Waiting" -CurrentOperation "Searching for events"
	$Events = Get-WinEvent -ComputerName $ComputerName -FilterHashtable @{logname="security";id=4624}
	$EventsTotal = $Events.Count
	$count = 0
	Foreach ($Event in $Events)
	{
		$count++
		$percent = "{0:N0}" -f $(($count/$EventsTotal)*100)
		Write-Progress -Activity "Log Parser" -Status "$percent% Complete" -CurrentOperation "Parsing events" -PercentComplete $percent
		$objResult = "" | Select time, user, user_domain, session_id, msad_action, workstation_name, source_network_address, source_port
		$objResult.Time = $Event.TimeCreated
		[void]($Event.Message -match $regex)
		$objResult.user = $matches.user
		$objResult.user_domain = $matches.user_domain
		$objResult.session_id = $matches.session_id
		$objResult.msad_action = $matches.msad_action
		$objResult.workstation_name = $matches.workstation_name
		$objResult.source_network_address = $matches.source_network_address
		$objResult.source_port = $matches.source_port
		[void]$ArrResults.Add($objResult)
	}
	return $ArrResults

Open in new window

0
 

Author Comment

by:nav2567
ID: 40444072
I create a ps1 file using the above and call it from a powershell window: GetEventLog.ps1 -ComputerName server1 and see the following error:

The term 'geteventlog.ps1' is not recognized as the name of a cmdlet, function, script file, or operable program. Che
ck the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:18
+ geteventlog.ps1 <<<<  -ComputerName server1
    + CategoryInfo          : ObjectNotFound: (geteventlog.ps1:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException


Suggestion [3,General]: The command geteventlog.ps1 was not found, but does exist in the current location. Windows Pow
erShell doesn't load commands from the current location by default. If you trust this command, instead type ".\checklogi
n_v2.ps1". See "get-help about_Command_Precedence" for more details.
0
 
LVL 17

Expert Comment

by:Learnctx
ID: 40444195
Ah yes Powershell won't execute a script from the current directory. So you either have to provide the full path (example below)...

c:\temp\scripts\scriptname.ps1

Open in new window


Or prefix the script with a .\ to tell Powershell to execute from the current directory (example below).

cd c:\temp\scripts
.\scriptname.ps1

Open in new window

0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
A brief introduction to what I consider to be the best editor for PowerShell.
This tutorial will walk an individual through the process of installing of Data Protection Manager on a server running Windows Server 2012 R2, including the prerequisites. Microsoft .Net 3.5 is required. To install this feature, go to Server Manager…
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

825 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question