Solved

audit an AD account that login to a specific domain computer.

Posted on 2014-11-11
10
111 Views
Last Modified: 2014-12-03
Hi,

Is there a way I can tell a particular AD account that login to a specific domain computer remotely?

Thanks.

Ed
0
Comment
Question by:nav2567
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
  • 3
10 Comments
 
LVL 11

Expert Comment

by:Joe Klimis
ID: 40435072
Hi Ed

you can view the events using Powershell , further events can be added as required.

open a powershell window and paste in the following.   Remember to change the "localhost" to the required workstation.

get-EventLog -LogName Security -InstanceId 4624 -ComputerName localhost 

Open in new window


This will display all the successfully logins,
0
 

Author Comment

by:nav2567
ID: 40435145
I do not see the result in the output file.  Please see the attached.  

Thanks.
result.png
0
 
LVL 11

Expert Comment

by:Joe Klimis
ID: 40435188
Hi

to all the detail of each windows event  you can do this
get-EventLog -LogName Security -InstanceId 4624 -ComputerName localhost  | fl

Open in new window



If there are just specific elements you are interested in , this can be refined, let me know your exact requirements.  
Joe
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

 

Author Comment

by:nav2567
ID: 40435407
Thanks.  

The result is now too much information..  

Is there a way I can display only the login ID and last login time for a particular system?

Thanks.
0
 
LVL 11

Expert Comment

by:Joe Klimis
ID: 40435543
Hi

Try this

get-EventLog -LogName Security -InstanceId 4624 -ComputerName localhost | 
select TimeGenerated,`
@{name="Username";expression={($_.message.split(":").trim()[9] -split "Acc")[0].trim()}},`
@{name="Domain";expression={$_.message.split(":").trim()[4].split("")[0]}},`
@{name="Workstation";expression={($_.message.split(":").trim()[18] -split "source")[0].trim()}}

Open in new window

0
 
LVL 17

Accepted Solution

by:
Learnctx earned 500 total points
ID: 40436309
This is a function I wrote for parsing logon events. Defaults to the localhost if a the ComputerName parameter is not set. Usage is simple:

$results = GetLogonEvents
Or
GetLogonEvents | Export-Csv -NoType whatever.csv
Or
GetLogonEvents -ComputerName ComputerNameHere

Function GetLogonEvents
{
	param (
		[string]$ComputerName = "localhost"
	)
	$ArrResults = New-Object System.Collections.ArrayList
	$regex = "(?ms)An account was (?<msad_action>.*?)[:\.]\s*\n.*New Logon:\s*\n.*?Account Name:\s*(?<user>.*?)\s*\n.*?Account Domain:\s*(?<user_domain>.*?)\s*\n.*Logon ID:\s*(?<session_id>.*?)\s*\n.*Network Information:\s\n.*?Workstation Name:\s*(?<workstation_name>.*?)\s*\n.*Source Network Address:\s*(?<source_network_address>.*?)\s*\n.*?Source Port:\s*(?<source_port>.*?)\s*\n.*"
	Write-Progress -Activity "Log Parser" -Status "Waiting" -CurrentOperation "Searching for events"
	$Events = Get-WinEvent -ComputerName $ComputerName -FilterHashtable @{logname="security";id=4624}
	$EventsTotal = $Events.Count
	$count = 0
	Foreach ($Event in $Events)
	{
		$count++
		$percent = "{0:N0}" -f $(($count/$EventsTotal)*100)
		Write-Progress -Activity "Log Parser" -Status "$percent% Complete" -CurrentOperation "Parsing events" -PercentComplete $percent
		$objResult = "" | Select time, user, user_domain, session_id, msad_action, workstation_name, source_network_address, source_port
		$objResult.Time = $Event.TimeCreated
		[void]($Event.Message -match $regex)
		$objResult.user = $matches.user
		$objResult.user_domain = $matches.user_domain
		$objResult.session_id = $matches.session_id
		$objResult.msad_action = $matches.msad_action
		$objResult.workstation_name = $matches.workstation_name
		$objResult.source_network_address = $matches.source_network_address
		$objResult.source_port = $matches.source_port
		[void]$ArrResults.Add($objResult)
	}
	return $ArrResults
}

Open in new window

0
 

Author Comment

by:nav2567
ID: 40439110
Learnctx, can I create a ps1 file and paste everything below and run it?  

GetLogonEvents -ComputerName SERVER_A

Function GetLogonEvents
{
      param (
            [string]$ComputerName = "localhost"
      )
      $ArrResults = New-Object System.Collections.ArrayList
      $regex = "(?ms)An account was (?<msad_action>.*?)[:\.]\s*\n.*New Logon:\s*\n.*?Account Name:\s*(?<user>.*?)\s*\n.*?Account Domain:\s*(?<user_domain>.*?)\s*\n.*Logon ID:\s*(?<session_id>.*?)\s*\n.*Network Information:\s\n.*?Workstation Name:\s*(?<workstation_name>.*?)\s*\n.*Source Network Address:\s*(?<source_network_address>.*?)\s*\n.*?Source Port:\s*(?<source_port>.*?)\s*\n.*"
      Write-Progress -Activity "Log Parser" -Status "Waiting" -CurrentOperation "Searching for events"
      $Events = Get-WinEvent -ComputerName $ComputerName -FilterHashtable @{logname="security";id=4624}
      $EventsTotal = $Events.Count
      $count = 0
      Foreach ($Event in $Events)
      {
            $count++
            $percent = "{0:N0}" -f $(($count/$EventsTotal)*100)
            Write-Progress -Activity "Log Parser" -Status "$percent% Complete" -CurrentOperation "Parsing events" -PercentComplete $percent
            $objResult = "" | Select time, user, user_domain, session_id, msad_action, workstation_name, source_network_address, source_port
            $objResult.Time = $Event.TimeCreated
            [void]($Event.Message -match $regex)
            $objResult.user = $matches.user
            $objResult.user_domain = $matches.user_domain
            $objResult.session_id = $matches.session_id
            $objResult.msad_action = $matches.msad_action
            $objResult.workstation_name = $matches.workstation_name
            $objResult.source_network_address = $matches.source_network_address
            $objResult.source_port = $matches.source_port
            [void]$ArrResults.Add($objResult)
      }
      return $ArrResults
}


JoeKlimis, I copy yours into a notepad and put everything in one line and run it.  That doesnt work.
0
 
LVL 17

Expert Comment

by:Learnctx
ID: 40443741
OK yeah I have written it as a function to be called. You can convert it over to a script by removing the function sections. Save it as GetEventLog.ps1 or whichever name suits best.

GetEventLog.ps1 -ComputerName Computer

	param (
		[string]$ComputerName = "localhost"
	)
	$ArrResults = New-Object System.Collections.ArrayList
	$regex = "(?ms)An account was (?<msad_action>.*?)[:\.]\s*\n.*New Logon:\s*\n.*?Account Name:\s*(?<user>.*?)\s*\n.*?Account Domain:\s*(?<user_domain>.*?)\s*\n.*Logon ID:\s*(?<session_id>.*?)\s*\n.*Network Information:\s\n.*?Workstation Name:\s*(?<workstation_name>.*?)\s*\n.*Source Network Address:\s*(?<source_network_address>.*?)\s*\n.*?Source Port:\s*(?<source_port>.*?)\s*\n.*"
	Write-Progress -Activity "Log Parser" -Status "Waiting" -CurrentOperation "Searching for events"
	$Events = Get-WinEvent -ComputerName $ComputerName -FilterHashtable @{logname="security";id=4624}
	$EventsTotal = $Events.Count
	$count = 0
	Foreach ($Event in $Events)
	{
		$count++
		$percent = "{0:N0}" -f $(($count/$EventsTotal)*100)
		Write-Progress -Activity "Log Parser" -Status "$percent% Complete" -CurrentOperation "Parsing events" -PercentComplete $percent
		$objResult = "" | Select time, user, user_domain, session_id, msad_action, workstation_name, source_network_address, source_port
		$objResult.Time = $Event.TimeCreated
		[void]($Event.Message -match $regex)
		$objResult.user = $matches.user
		$objResult.user_domain = $matches.user_domain
		$objResult.session_id = $matches.session_id
		$objResult.msad_action = $matches.msad_action
		$objResult.workstation_name = $matches.workstation_name
		$objResult.source_network_address = $matches.source_network_address
		$objResult.source_port = $matches.source_port
		[void]$ArrResults.Add($objResult)
	}
	return $ArrResults

Open in new window

0
 

Author Comment

by:nav2567
ID: 40444072
I create a ps1 file using the above and call it from a powershell window: GetEventLog.ps1 -ComputerName server1 and see the following error:

The term 'geteventlog.ps1' is not recognized as the name of a cmdlet, function, script file, or operable program. Che
ck the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:18
+ geteventlog.ps1 <<<<  -ComputerName server1
    + CategoryInfo          : ObjectNotFound: (geteventlog.ps1:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException


Suggestion [3,General]: The command geteventlog.ps1 was not found, but does exist in the current location. Windows Pow
erShell doesn't load commands from the current location by default. If you trust this command, instead type ".\checklogi
n_v2.ps1". See "get-help about_Command_Precedence" for more details.
0
 
LVL 17

Expert Comment

by:Learnctx
ID: 40444195
Ah yes Powershell won't execute a script from the current directory. So you either have to provide the full path (example below)...

c:\temp\scripts\scriptname.ps1

Open in new window


Or prefix the script with a .\ to tell Powershell to execute from the current directory (example below).

cd c:\temp\scripts
.\scriptname.ps1

Open in new window

0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A company’s centralized system that manages user data, security, and distributed resources is often a focus of criminal attention. Active Directory (AD) is no exception. In truth, it’s even more likely to be targeted due to the number of companies …
Always backup Domain, SYSVOL etc.using processes according to Microsoft Best Practices. This is meant as a disaster recovery process for small environments that did not implement backup processes and did not run a secondary domain controller that ne…
In this Micro Tutorial viewers will learn how to restore their server from Bare Metal Backup image created with Windows Server Backup feature. As an example Windows 2012R2 is used.
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question