Solved

audit an AD account that login to a specific domain computer.

Posted on 2014-11-11
10
108 Views
Last Modified: 2014-12-03
Hi,

Is there a way I can tell a particular AD account that login to a specific domain computer remotely?

Thanks.

Ed
0
Comment
Question by:nav2567
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
  • 3
10 Comments
 
LVL 11

Expert Comment

by:Joe Klimis
ID: 40435072
Hi Ed

you can view the events using Powershell , further events can be added as required.

open a powershell window and paste in the following.   Remember to change the "localhost" to the required workstation.

get-EventLog -LogName Security -InstanceId 4624 -ComputerName localhost 

Open in new window


This will display all the successfully logins,
0
 

Author Comment

by:nav2567
ID: 40435145
I do not see the result in the output file.  Please see the attached.  

Thanks.
result.png
0
 
LVL 11

Expert Comment

by:Joe Klimis
ID: 40435188
Hi

to all the detail of each windows event  you can do this
get-EventLog -LogName Security -InstanceId 4624 -ComputerName localhost  | fl

Open in new window



If there are just specific elements you are interested in , this can be refined, let me know your exact requirements.  
Joe
0
Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

 

Author Comment

by:nav2567
ID: 40435407
Thanks.  

The result is now too much information..  

Is there a way I can display only the login ID and last login time for a particular system?

Thanks.
0
 
LVL 11

Expert Comment

by:Joe Klimis
ID: 40435543
Hi

Try this

get-EventLog -LogName Security -InstanceId 4624 -ComputerName localhost | 
select TimeGenerated,`
@{name="Username";expression={($_.message.split(":").trim()[9] -split "Acc")[0].trim()}},`
@{name="Domain";expression={$_.message.split(":").trim()[4].split("")[0]}},`
@{name="Workstation";expression={($_.message.split(":").trim()[18] -split "source")[0].trim()}}

Open in new window

0
 
LVL 17

Accepted Solution

by:
Learnctx earned 500 total points
ID: 40436309
This is a function I wrote for parsing logon events. Defaults to the localhost if a the ComputerName parameter is not set. Usage is simple:

$results = GetLogonEvents
Or
GetLogonEvents | Export-Csv -NoType whatever.csv
Or
GetLogonEvents -ComputerName ComputerNameHere

Function GetLogonEvents
{
	param (
		[string]$ComputerName = "localhost"
	)
	$ArrResults = New-Object System.Collections.ArrayList
	$regex = "(?ms)An account was (?<msad_action>.*?)[:\.]\s*\n.*New Logon:\s*\n.*?Account Name:\s*(?<user>.*?)\s*\n.*?Account Domain:\s*(?<user_domain>.*?)\s*\n.*Logon ID:\s*(?<session_id>.*?)\s*\n.*Network Information:\s\n.*?Workstation Name:\s*(?<workstation_name>.*?)\s*\n.*Source Network Address:\s*(?<source_network_address>.*?)\s*\n.*?Source Port:\s*(?<source_port>.*?)\s*\n.*"
	Write-Progress -Activity "Log Parser" -Status "Waiting" -CurrentOperation "Searching for events"
	$Events = Get-WinEvent -ComputerName $ComputerName -FilterHashtable @{logname="security";id=4624}
	$EventsTotal = $Events.Count
	$count = 0
	Foreach ($Event in $Events)
	{
		$count++
		$percent = "{0:N0}" -f $(($count/$EventsTotal)*100)
		Write-Progress -Activity "Log Parser" -Status "$percent% Complete" -CurrentOperation "Parsing events" -PercentComplete $percent
		$objResult = "" | Select time, user, user_domain, session_id, msad_action, workstation_name, source_network_address, source_port
		$objResult.Time = $Event.TimeCreated
		[void]($Event.Message -match $regex)
		$objResult.user = $matches.user
		$objResult.user_domain = $matches.user_domain
		$objResult.session_id = $matches.session_id
		$objResult.msad_action = $matches.msad_action
		$objResult.workstation_name = $matches.workstation_name
		$objResult.source_network_address = $matches.source_network_address
		$objResult.source_port = $matches.source_port
		[void]$ArrResults.Add($objResult)
	}
	return $ArrResults
}

Open in new window

0
 

Author Comment

by:nav2567
ID: 40439110
Learnctx, can I create a ps1 file and paste everything below and run it?  

GetLogonEvents -ComputerName SERVER_A

Function GetLogonEvents
{
      param (
            [string]$ComputerName = "localhost"
      )
      $ArrResults = New-Object System.Collections.ArrayList
      $regex = "(?ms)An account was (?<msad_action>.*?)[:\.]\s*\n.*New Logon:\s*\n.*?Account Name:\s*(?<user>.*?)\s*\n.*?Account Domain:\s*(?<user_domain>.*?)\s*\n.*Logon ID:\s*(?<session_id>.*?)\s*\n.*Network Information:\s\n.*?Workstation Name:\s*(?<workstation_name>.*?)\s*\n.*Source Network Address:\s*(?<source_network_address>.*?)\s*\n.*?Source Port:\s*(?<source_port>.*?)\s*\n.*"
      Write-Progress -Activity "Log Parser" -Status "Waiting" -CurrentOperation "Searching for events"
      $Events = Get-WinEvent -ComputerName $ComputerName -FilterHashtable @{logname="security";id=4624}
      $EventsTotal = $Events.Count
      $count = 0
      Foreach ($Event in $Events)
      {
            $count++
            $percent = "{0:N0}" -f $(($count/$EventsTotal)*100)
            Write-Progress -Activity "Log Parser" -Status "$percent% Complete" -CurrentOperation "Parsing events" -PercentComplete $percent
            $objResult = "" | Select time, user, user_domain, session_id, msad_action, workstation_name, source_network_address, source_port
            $objResult.Time = $Event.TimeCreated
            [void]($Event.Message -match $regex)
            $objResult.user = $matches.user
            $objResult.user_domain = $matches.user_domain
            $objResult.session_id = $matches.session_id
            $objResult.msad_action = $matches.msad_action
            $objResult.workstation_name = $matches.workstation_name
            $objResult.source_network_address = $matches.source_network_address
            $objResult.source_port = $matches.source_port
            [void]$ArrResults.Add($objResult)
      }
      return $ArrResults
}


JoeKlimis, I copy yours into a notepad and put everything in one line and run it.  That doesnt work.
0
 
LVL 17

Expert Comment

by:Learnctx
ID: 40443741
OK yeah I have written it as a function to be called. You can convert it over to a script by removing the function sections. Save it as GetEventLog.ps1 or whichever name suits best.

GetEventLog.ps1 -ComputerName Computer

	param (
		[string]$ComputerName = "localhost"
	)
	$ArrResults = New-Object System.Collections.ArrayList
	$regex = "(?ms)An account was (?<msad_action>.*?)[:\.]\s*\n.*New Logon:\s*\n.*?Account Name:\s*(?<user>.*?)\s*\n.*?Account Domain:\s*(?<user_domain>.*?)\s*\n.*Logon ID:\s*(?<session_id>.*?)\s*\n.*Network Information:\s\n.*?Workstation Name:\s*(?<workstation_name>.*?)\s*\n.*Source Network Address:\s*(?<source_network_address>.*?)\s*\n.*?Source Port:\s*(?<source_port>.*?)\s*\n.*"
	Write-Progress -Activity "Log Parser" -Status "Waiting" -CurrentOperation "Searching for events"
	$Events = Get-WinEvent -ComputerName $ComputerName -FilterHashtable @{logname="security";id=4624}
	$EventsTotal = $Events.Count
	$count = 0
	Foreach ($Event in $Events)
	{
		$count++
		$percent = "{0:N0}" -f $(($count/$EventsTotal)*100)
		Write-Progress -Activity "Log Parser" -Status "$percent% Complete" -CurrentOperation "Parsing events" -PercentComplete $percent
		$objResult = "" | Select time, user, user_domain, session_id, msad_action, workstation_name, source_network_address, source_port
		$objResult.Time = $Event.TimeCreated
		[void]($Event.Message -match $regex)
		$objResult.user = $matches.user
		$objResult.user_domain = $matches.user_domain
		$objResult.session_id = $matches.session_id
		$objResult.msad_action = $matches.msad_action
		$objResult.workstation_name = $matches.workstation_name
		$objResult.source_network_address = $matches.source_network_address
		$objResult.source_port = $matches.source_port
		[void]$ArrResults.Add($objResult)
	}
	return $ArrResults

Open in new window

0
 

Author Comment

by:nav2567
ID: 40444072
I create a ps1 file using the above and call it from a powershell window: GetEventLog.ps1 -ComputerName server1 and see the following error:

The term 'geteventlog.ps1' is not recognized as the name of a cmdlet, function, script file, or operable program. Che
ck the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:18
+ geteventlog.ps1 <<<<  -ComputerName server1
    + CategoryInfo          : ObjectNotFound: (geteventlog.ps1:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException


Suggestion [3,General]: The command geteventlog.ps1 was not found, but does exist in the current location. Windows Pow
erShell doesn't load commands from the current location by default. If you trust this command, instead type ".\checklogi
n_v2.ps1". See "get-help about_Command_Precedence" for more details.
0
 
LVL 17

Expert Comment

by:Learnctx
ID: 40444195
Ah yes Powershell won't execute a script from the current directory. So you either have to provide the full path (example below)...

c:\temp\scripts\scriptname.ps1

Open in new window


Or prefix the script with a .\ to tell Powershell to execute from the current directory (example below).

cd c:\temp\scripts
.\scriptname.ps1

Open in new window

0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Always backup Domain, SYSVOL etc.using processes according to Microsoft Best Practices. This is meant as a disaster recovery process for small environments that did not implement backup processes and did not run a secondary domain controller that ne…
Did you know that more than 4 billion data records have been recorded as lost or stolen since 2013? It was a staggering number brought to our attention during last week’s ManageEngine webinar, where attendees received a comprehensive look at the ma…
In this Micro Tutorial viewers will learn how to use Windows Server Backup to create full image of their system. Tutorial shows how to install Windows Server Backup Feature on Windows 2012R2 and how to configure scheduled Bare Metal Recovery backup.…
This tutorial will walk an individual through the process of configuring basic necessities in order to use the 2010 version of Data Protection Manager. These include storage, agents, and protection jobs. Launch Data Protection Manager from the deskt…

736 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question